fix(employees): resolve User through the contract surface

test_plugins_only_import_contract_surface has been failing on main since
9a2d0cc: the employee name resolver imported shopdb.core.models directly.
shopdb.api already exports User (contract 0.13.0), so this is the same object
reached the way ADR-001 requires.

plugins/employees/api/routes.py

@@ -153,7 +153,7 @@ def resolve_employee_display_name(sso):
     #    location not carried in the directory). Their name lives on the User
     #    record; GE usernames are the SSO. Photo still falls back to the GE mark.
     try:
-        from shopdb.core.models import User
+        from shopdb.api import User
         user = User.query.filter_by(username=str(sso)).first()
         if user:
             name = f'{(user.firstname or "").strip()} {(user.lastname or "").strip()}'.strip()