Add Tally onboarding intake workflow

.env.example

@@ -237,6 +237,19 @@ INTAKE_RESUME_FETCH_TIMEOUT_SECONDS=20.0
 INTAKE_RESUME_MAX_REDIRECTS=3
 # Optional comma-separated host allowlist for intake resume URL fetches
 INTAKE_RESUME_ALLOWED_HOSTS=
+# Onboarding Tally intake webhooks. ONBOARDING_TALLY_API_KEY is optional for
+# future API backfills; webhook submissions use the signing secret for auth.
+# Legacy aliases still work: TALLY_API_KEY, TALLY_WEBHOOK_SIGNING_SECRET,
+# TALLY_ALLOWED_FORM_IDS.
+ONBOARDING_TALLY_API_KEY=
+ONBOARDING_TALLY_WEBHOOK_SIGNING_SECRET=
+# Required for Tally webhook intake; comma-separated accepted onboarding form IDs.
+ONBOARDING_TALLY_ALLOWED_FORM_IDS=
+# Resume files are untrusted. Keep scanning required in production and configure
+# a scanner command; use "{path}" where the downloaded resume path should go.
+INTAKE_RESUME_REQUIRE_VIRUS_SCAN=false
+INTAKE_RESUME_VIRUS_SCAN_COMMAND=
+INTAKE_RESUME_VIRUS_SCAN_TIMEOUT_SECONDS=30.0
 EMAIL_RESUME_INTAKE_ENABLED=false
 EMAIL_RESUME_ALLOWED_EXTENSIONS=pdf,doc,docx
 EMAIL_RESUME_MAX_FILE_SIZE_MB=10