fix(0pt): allow X-Internal-Token on internal ER candidates

P0ST and the acquisition workers call /api/0pt/internal/er/candidates with the shared service token; the route already verifies it, but middleware rejected it before the handler. Adds the route to the existing explicit allowlist.

middleware.ts

@@ -31,6 +31,7 @@ const INTERNAL_SERVICE_ROUTES: RegExp[] = [
   /^\/api\/0pt\/canonical\/facts$/,
   /^\/api\/0pt\/internal\/evidence-outbox\/dispatch$/,
   /^\/api\/0pt\/internal\/er\/candidates$/,
+  /^\/api\/0pt\/internal\/er\/candidates$/,
   /^\/api\/0pt\/search\/definitions$/,
 ];