Self-hosted employee directory (in-app management + CSV import)

Most sites have no external HR database, so add a self-hosted directory mode.

- New employee_directory_mode setting: 'external' (default; read a separate HR
  DB, unchanged) or 'selfhosted' (app-owned table).
- DirectoryEmployee model + directoryemployees table (migration 7d16). to_dict
  emits the same keys the external contract uses (SSO/First_Name/...), so both
  modes share one response shape and the frontend is unchanged.
- Employee search / single / batch lookup branch on the mode.
- Self-hosted-only management endpoints: list, create, update, delete, and CSV
  import (upsert by SSO). Guarded so they only work in self-hosted mode.
- EmployeeDirectory.vue management page (Settings > Locations & Organization):
  table + search + pagination, add/edit/delete, CSV import (file or paste).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

migrations/versions/7d16_directoryemployees.py

@@ -0,0 +1,31 @@
+"""Self-hosted employee directory table
+
+Revision ID: 7d16_directoryemployees
+Revises: 7d15_warranties
+Create Date: 2026-07-10
+
+"""
+from alembic import op
+import sqlalchemy as sa
+
+
+revision = '7d16_directoryemployees'
+down_revision = '7d15_warranties'
+branch_labels = None
+depends_on = None
+
+
+def upgrade():
+    op.create_table(
+        'directoryemployees',
+        sa.Column('sso', sa.Integer(), primary_key=True, autoincrement=False),
+        sa.Column('firstname', sa.String(length=100), nullable=False),
+        sa.Column('lastname', sa.String(length=100), nullable=False),
+        sa.Column('team', sa.String(length=100), nullable=True),
+        sa.Column('role', sa.String(length=100), nullable=True),
+        sa.Column('picture', sa.String(length=255), nullable=True),
+    )
+
+
+def downgrade():
+    op.drop_table('directoryemployees')