Employees: external photo base URL is a setting

External HR Picture values are relative paths; the resolver hardcoded
/static/employees/ (which the SPA then mounts under the subpath, e.g.
/ops/static/...), but sites like WJ serve those photos from the
classic EmployeeDBAPP on another URL entirely. New setting
employee_photo_base_url (blank keeps the old behavior; a full URL like
https://host/EmployeeDBAPP/images/ passes through withBase untouched),
declared in the plugin config schema.

plugins/employees/plugin.py

@@ -79,6 +79,11 @@ class EmployeesPlugin(BasePlugin):
         """Employee directory DB connection. Host/name/user are settings the
         wizard can edit; the password stays in .env (emitted, not stored)."""
         return [
+            {'key': 'employee_photo_base_url', 'label': 'Photo base URL',
+             'type': 'text', 'secret': False,
+             'help': 'Where external HR relative Picture paths resolve, e.g. '
+                     'https://host/EmployeeDBAPP/images/. Blank = this '
+                     'site\'s /static/employees/.'},
             {'key': 'employee_db_host', 'label': 'Employee DB host', 'type': 'text',
              'secret': False, 'default': 'localhost',
              'help': 'This DB must expose an "employees" table or view with columns '