Returns a candidate profile addressed by the caller's own identifier. The lookup is scoped to the authenticated organization group, so an external id in use by another tenant is never reachable and returns 404 — the same response as an external id that exists nowhere. Where more than one candidate in the group somehow shares an external id, the first match is returned and the collision is logged. The response is identical in shape to GET /v1/candidates/{id}.