Add external import sources, work history, screening fields and Phase 1 docs

- New ExternalImportSource and ExternalWorkHistoryEntry models, controller and migrations
- Screening fields on external profile imports
- Admin and provider profile views, routes and workflow tests updated
- Phase 1 validation, route inventory, gap report template and roadmap docs
- Add the Google Sheets work-order parser tool (tools/google-sheets-wo-parser)

tools/google-sheets-wo-parser/PRIVACY.md

@@ -0,0 +1,25 @@
+# Privacy and safety
+
+## Data boundary
+
+This project is designed so each user has their own Google Sheet and their own bound Apps Script project. There is no shared inbox, central database, hosted API, or telemetry.
+
+The parser searches recent Inbox messages using Field Nation and WorkMarket sender patterns, then reads only the matching messages. It writes parsed work-order fields and the Gmail message ID to that user's Sheet. It does **not** write full email bodies to the Sheet by default.
+
+## Google permission scope
+
+Apps Script's `GmailApp` service requires Gmail authorization. Google presents this as broad Gmail access; the script cannot make Google enforce a single-label permission. That is why this project must stay open source and why users should inspect it before authorizing.
+
+The code limits its own search to recent Inbox messages matching Field Nation or WorkMarket sender patterns and performs no outbound HTTP requests. It never sends, forwards, deletes, marks read, requests, accepts, or declines any work order.
+
+## Safe use
+
+- The default automatic scan does not inspect unrelated sender patterns. A Gmail label or filter is optional if you want additional organization.
+- Keep the Sheet private because it contains the work-order fields extracted from matching notices.
+- Treat the Sheet as private operational data and do not share it publicly.
+- Review the `Needs Review` queue after a provider changes an email template.
+- Never paste passwords, API keys, OAuth tokens, or full private emails into a bug report.
+
+## Platform boundary
+
+This parser acts only on emails the user already receives. It does not automate Field Nation or WorkMarket web sessions and does not circumvent their access controls.