Apply an existing tag to a candidate. Both candidate_id and candidate_tag_id are required; the tag must already exist in the organization's candidate-tag dictionary (create it via POST /v3/candidate_tags first if needed). Applying a tag a candidate already has is idempotent at the data level but returns a 422 on duplicate. This replaces V1's batch PUT /v1/candidates/{id}/tags workflow — to attach multiple tags, issue one POST per tag.