printedparts: badge resolution honors the employee directory mode

The resolver only read the self-hosted directory table, which is empty
at sites running the external HR directory - every kiosk badge fell to
the deny policy. It now branches on employee_directory_mode like the
usb plugin: selfhosted looks up DirectoryEmployee by SSO; external
queries the HR directory via employee_connection, resolving PayNo
badges by their real PayNo column and recovering the employee's SSO.

docs/PLUGIN-LAB-PRINTEDPARTS.md

@@ -385,6 +385,18 @@ cannot carry a JWT header), and the reports (product-wide jwt-optional
 convention). Grant `printedparts.view` to the roles that should see the
 catalog - admins bypass as always.
 
+## Stage 16b (extension) - badge resolution honors the directory mode
+
+Prod runs the employee directory in EXTERNAL mode (live HR database), where
+the self-hosted directoryemployees table is empty - so the original
+resolver's every lookup missed and the deny policy blocked the kiosk. The
+resolver now branches on the same employee_directory_mode setting the
+usb/employees plugins use: selfhosted reads DirectoryEmployee by SSO;
+external queries the HR directory via employee_connection() - and resolves
+PayNo badges by their actual PayNo column, recovering the real SSO, which
+the self-hosted table cannot do. Dual-backend lesson in miniature: a plugin
+that resolves people must honor the site's directory mode.
+
 ## Stage 16 (extension) - kiosk touch fixes from first hands-on use
 
 First real touchscreen session found two problems worth their own stage: