Fix top Investor Signals review blockers

[georgeatparallel]

Why this change

PR parallel-web#53 has three failure modes that can break a workflow or present research under the wrong field.

1. Bulk polling loses the job ID

The start endpoint returns job_id, but the status endpoint did not. The frontend replaces its job state with each status response, so after the first poll the next request and CSV export used an undefined ID.

Fix: Include job_id in every status response. The backend now returns the complete BulkJob contract expected by callers.

2. Failed webhooks cannot retry

The receiver marked a webhook ID as seen before processing began. If research, CRM lookup, Slack delivery, or request cancellation failed, Parallel retried the delivery but the receiver discarded it as a duplicate. That could silently lose a signal.

Fix: Validate first, reserve the ID immediately before side effects, and release the reservation on errors or cancellation. Concurrent duplicates remain blocked while failed deliveries remain retryable.

3. Custom answers can be assigned to the wrong question

Answer matching tried the echoed question first, then fell back to array position. If the model omitted an earlier answer, a later cited answer could be attached to the wrong field.

Fix: Match only by the required echoed question. Unmatched answers now return null, preserving the recipe's no-misattribution rule.

Scope

This is a narrow stacked fix for the top three review findings. It does not address the remaining follow-up findings from the PR parallel-web#53 review.

Validation

• 57 backend tests passed
• 9 frontend tests passed
• Ruff passed
• TypeScript and Vite production build passed
• pip check passed
• git diff --check passed

Stacked on parallel-web#53 at 3191250.