feat(portal): reuse unlock code for protected downloads

www/README.md

@@ -619,7 +619,13 @@ dry-run, rollback, the encrypted production portal input and the separate
 one-time employee-resource installer. The server-side installer is a root-only
 POSIX shell script using NixOS base tools; it does not require Node.js on
 Contabo. Ordinary releases never copy employee documents into `dist`;
-protected staff and management resources remain under server-controlled Basic Auth namespaces. The accepted interim portal is
+protected staff and management resources remain under server-controlled Basic
+Auth namespaces. After a successful unlock, the page keeps that role's code
+only in memory and uses it for same-origin authenticated document fetches. The
+response is downloaded as a local Blob, so employees do not receive a second
+browser authentication prompt. Cross-role requests are stopped before
+credentials are sent; direct resource URLs still require nginx authentication.
+Codes are never put in URLs or browser storage. The accepted interim portal is
 explicitly non-PHI.
 
 ### Google Ads consultation-form conversion handoff