AI ingestion: dynamic role/category creation + tags, hardcoded read-only prompt

- Unknown roles from the AI are now resolved-or-CREATED (Persian-normalized dedupe) instead of dropped/fallback; new role gets the AI's category, assigned to the applicant.
- AI output gains category + tags; AI-detected skills/requirements (ICU, MMT, پروانه‌دار…) now fold into the applicant's searchable Tags.
- System prompt is hardcoded in AppSetting.DefaultPrompt and used directly by the auditor; admin sees it read-only (cannot edit/break it).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/JobsMedical.Web/Services/Scraping/SettingsService.cs

@@ -31,8 +31,7 @@ public class SettingsService
         s.AiEndpoint = incoming.AiEndpoint?.Trim();
         s.AiApiKey = incoming.AiApiKey?.Trim();
         s.AiModel = incoming.AiModel?.Trim();
-        s.AiSystemPrompt = string.IsNullOrWhiteSpace(incoming.AiSystemPrompt)
-            ? AppSetting.DefaultPrompt : incoming.AiSystemPrompt;
+        s.AiSystemPrompt = AppSetting.DefaultPrompt;   // hardcoded & read-only — keep the column in sync
         s.AiAutoApprove = incoming.AiAutoApprove;
         s.AiUseProxy = incoming.AiUseProxy;
         // Channel scraping sources