Update candidate referral consent and mark token used

Your referral consent tokens arrive via webhook without ATS flags, forcing recruiters to verify consent manually. It updates candidate consent and marks tokens used so recruiters can proceed same day.