Retrieves a single candidate by ID, scoped to the given company and position, and returns the full candidate profile (contact info, source, stage, resume, education, work history, tags, scoring, etc.).

Note: resume.url, if present, is rewritten to point back to this API's /resume sub-endpoint rather than the raw file location. Returns 412 if the candidate exists but is not on the specified position, and 401 if the caller isn't authorized to view the candidate.