Shopfloor feed resolves employee names live when none is stored

Photos already resolved through the directory at read time, but names
only came from the stored employeename column - empty after a
shopdb-only import, so recertification/recognition cards showed bare
SSOs. New resolve_employee_display_name in the employees plugin
(mode-aware: self-hosted table or external HR) backs a fallback in
both the single-card and split-per-employee paths; stored names still
win when present.

plugins/employees/api/routes.py

@@ -116,6 +116,36 @@ def _hr_picture(sso):
         return None
 
 
+def resolve_employee_display_name(sso):
+    """Display name ("First Last") for an SSO in either directory mode.
+
+    The shopfloor feed uses this as a live fallback when a notification has
+    no stored employeename (e.g. imported without the employee source).
+    None on any miss."""
+    if sso is None or not str(sso).isdigit():
+        return None
+    if _selfhosted():
+        emp = db.session.get(DirectoryEmployee, int(sso))
+        if emp:
+            return f'{emp.firstname} {emp.lastname}'.strip() or None
+        return None
+    try:
+        conn = employee_connection()
+        with conn.cursor() as cur:
+            cur.execute(
+                'SELECT First_Name, Last_Name FROM employees WHERE SSO = %s',
+                (int(sso),))
+            row = cur.fetchone()
+        conn.close()
+        if row:
+            first = row.get('First_Name') or ''
+            last = row.get('Last_Name') or ''
+            return f'{first.strip()} {last.strip()}'.strip() or None
+    except Exception:
+        pass
+    return None
+
+
 def resolve_employee_photo_url(sso, external_picture=None):
     """Single resolver both consumers share: the display photo URL for an SSO.