feat(portal): reuse unlock code for protected downloads

www/integrations/employee-portal/README.md

@@ -5,6 +5,16 @@ staff and management portal content and the interim shared-code presentation.
 Browser-side decryption remains access friction rather than individual
 authentication, revocation, a secure session, or a HIPAA determination.
 
+The same successfully validated code authorizes protected document downloads
+for that role during the current page session. The browser keeps it only in a
+closure, performs a same-origin authenticated fetch, and saves the returned
+document without opening nginx's native Basic Auth dialog. Staff uses the
+`staff` username and stream `b`; management uses the `management` username and
+stream `a`. Direct URLs remain nginx-protected, cross-role fetches are rejected
+before credentials are sent, and failed authenticated downloads show an inline
+error without direct-navigation fallback. No code enters a URL, browser
+storage, public artifact, or log.
+
 ## Approved production ciphertext
 
 An indexing-enabled production build may include one owner-approved encrypted

www/integrations/nixos/deploy.md

@@ -92,3 +92,13 @@ resource namespaces, denial cases, redirects, Form A, IPv4 and IPv6. Portal
 shared-code rotation is coordinated: update VPS SOPS inputs and privately
 re-encrypt the browser payload together. This interim portal is non-PHI and is
 not an employee identity system.
+
+The portal uses one code entry per page session. A successful decrypt retains
+the code only in page memory and sends the matching fixed username (`staff` or
+`management`) in an explicit same-origin Basic Authorization header when a
+protected link is clicked. It downloads the authenticated response as a Blob
+and never navigates directly to the protected URL after an error. Verify that
+ordinary clicks download without a native credential dialog, inline errors
+appear for denied or unavailable files, direct unauthenticated requests remain
+401, and neither role can request the other namespace. Reloading, leaving the
+page, or an Astro page swap discards the in-memory credential.