[Fixed] Security hardening for candidate and job activities

Fixes

• Candidate and job activity feeds are now restricted to your own organization, closing a loophole that previously let some users view another company’s SMS threads or job events.
• An old, hidden “share candidate notes” endpoint has been fully disabled to eliminate an unused but potentially risky path (no visible UI was affected).