Global search: find employees in selfhosted mode, not just external HR DB

_search_employees always queried the external HR database (employee_connection),
so a site running the selfhosted employee directory (the app-owned
directoryemployees table) got zero employee results - searching an SSO or name
found nothing, and there was no way to reach the employee profile. Made it
mode-aware via the employee_directory_mode setting: selfhosted -> query the
DirectoryEmployee table (lazy, plugin-guarded); external -> the HR DB as before.

Verified: SSO 210009518 -> Jeff Pierce -> /employees/210009518; name "Pierce"
-> Pierce Cox, Andy Pierce, Jeff Pierce.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

shopdb/core/api/search.py

@@ -219,29 +219,47 @@ def _search_knowledgebase(query, search_term):
     return results
 
 
+def _employee_rows(search_term):
+    """Employee rows matching search_term, from the SELFHOSTED directory table
+    or the external HR DB per the employee_directory_mode setting. Returns dicts
+    shaped like the external query (SSO/First_Name/Last_Name/Team/Role)."""
+    settings = get_cached_settings()
+    mode = (settings.get('employee_directory_mode') or 'external').lower()
+    if mode == 'selfhosted':
+        try:
+            from plugins.employees.models import DirectoryEmployee
+        except ImportError:
+            return []
+        rows = DirectoryEmployee.query.filter(
+            db.or_(
+                DirectoryEmployee.firstname.ilike(search_term),
+                DirectoryEmployee.lastname.ilike(search_term),
+                db.cast(DirectoryEmployee.sso, db.String).ilike(search_term),
+            )
+        ).order_by(DirectoryEmployee.lastname, DirectoryEmployee.firstname).limit(10).all()
+        return [{'SSO': e.sso, 'First_Name': e.firstname or '',
+                 'Last_Name': e.lastname or '', 'Team': e.team, 'Role': e.role}
+                for e in rows]
+    # External HR DB: shared env-backed connection helper; never hardcode creds.
+    from shopdb.utils.employee_db import employee_connection
+    emp_conn = employee_connection()
+    with emp_conn.cursor() as cur:
+        cur.execute('''
+            SELECT SSO, First_Name, Last_Name, Team, Role
+            FROM employees
+            WHERE First_Name LIKE %s OR Last_Name LIKE %s OR CAST(SSO AS CHAR) LIKE %s
+            ORDER BY Last_Name, First_Name LIMIT 10
+        ''', (search_term, search_term, search_term))
+        rows = cur.fetchall()
+    emp_conn.close()
+    return rows
+
+
 def _search_employees(query, search_term):
-    """Search Employees in separate wjf_employees database."""
+    """Search employees (selfhosted directory or external HR DB, per mode)."""
     results = []
     try:
-        # Use the shared env-backed connection helper; never hardcode creds.
-        from shopdb.utils.employee_db import employee_connection
-        emp_conn = employee_connection()
-
-        with emp_conn.cursor() as cur:
-            cur.execute('''
-                SELECT SSO, First_Name, Last_Name, Team, Role
-                FROM employees
-                WHERE First_Name LIKE %s
-                   OR Last_Name LIKE %s
-                   OR CAST(SSO AS CHAR) LIKE %s
-                ORDER BY Last_Name, First_Name
-                LIMIT 10
-            ''', (search_term, search_term, search_term))
-            employees = cur.fetchall()
-
-        emp_conn.close()
-
-        for emp in employees:
+        for emp in _employee_rows(search_term):
             full_name = f"{emp['First_Name'].strip()} {emp['Last_Name'].strip()}"
             sso_str = str(emp['SSO'])