Build the pages for "Job applications". The backend runs on Typestate and answers these web endpoints:
GET /jobs: Your careers page lists the open jobs. Who may call: anyone.
POST /jobs/apply: Your careers page posts each application here, with the CV. Who may call: anyone.
POST /jobs: Only you, with your key, post a job. Who may call: you, with your key.
POST /jobs/close: Only you, with your key, close a job. Who may call: you, with your key.
POST /applications/move: Only you, with your key, move an applicant. Who may call: you, with your key.
POST /applications/reject: Only you, with your key, turn an applicant down. Who may call: you, with your key.
GET /applications: Only you, with your key, read the applications. Who may call: you, with your key.
People sign up at POST /auth/signup and sign in at POST /auth/login, which answers a token. Send it as Authorization: Bearer <token>.
A refused call answers a sentence that can be shown to the person as it is.