feat: volunteer work section with timeline integration

[rorar]

Summary

• Volunteer work section with roles, timeline integration, and Schema.org markup
• XSS, path traversal, input validation, and performance fixes (P0/P1)
• Dataset authorization fix (S12), Schema.org on volunteer cards (CQ4), sort stability (CQ5)
• i18n support across all 8 languages
• Allium specs for CV Manager domain model
• Import utilities with JSON_SAFE_PARSE and sanitization

Test plan

• All 142 tests pass
• Manual testing of volunteer work CRUD in admin UI
• Verified public timeline includes volunteer roles
• Verified Schema.org markup in public view

[vincentmakes]

Thanks @rorar and the security hardening is appreciated.
That said, the main issue is architectural: we already have a first-class extension mechanism for exactly this use case. docs/guide/custom-sections.md explicitly cites volunteer work as a fit for the Vertical List layout, and additional-experiences is very close to what you’ve built. The only genuinely new requirement is multiple roles per organization — that should be solved by extending additional-experiences (optional roles array) or adding a volunteer-roles layout_type to custom_sections, not by introducing a new table, new endpoints, new section enum entry, new migrations, and new ATS/PDF code. Could you rework the feature on top of the custom-section architecture? If there’s a reason that route is insufficient, please make the case in the PR description.
On top of that, a number of repo conventions haven’t been followed. Please re-read CLAUDE.md and CONTRIBUTING.md carefully before the next iteration as both spell these out:
• No version bump (package.json, package-lock.json, version.json)
• No CHANGELOG.md entry
• PR batches unrelated changes (feature + security + refactor + specs)
• No UI screenshots
• Security fixes referenced only by codename, no root-cause explanation
• User documentation missing (docs/guide/sections.md out-of-date, no volunteer.md page, no translated variants, README.md not updated)
• Feature is on-by-default for all upgrading users (should be opt-in via migration)
• Hardcoded English fallbacks in JS (t('...') || 'English') and mistranslated action.add_volunteer in 6 locales
• Unrelated i18n churn (casing changes, blank-line removals, stray JSON whitespace)
• serveDatasetData may 404 the default dataset via /v/{slug}
• performImport changes import semantics for partial payloads
• Dead country_code migration on volunteer_work
• Timeline dot anchor visual change bundled silently
• Unexplained specs/*.allium files + tooling .gitignore entries
Suggested split once the architecture is sorted:
• PR A: security fixes — PATCH
• PR B: refactors (timeline/import) + indexes — PATCH
• PR C: volunteer feature on the custom-section architecture + docs — MINOR
• PR D: spec files / tooling (or keep local)

Thanks again for the work.