feat(portal): reuse unlock code for protected downloads

www/integrations/employee-portal/README.md

@@ -5,6 +5,16 @@ staff and management portal content and the interim shared-code presentation.
 Browser-side decryption remains access friction rather than individual
 authentication, revocation, a secure session, or a HIPAA determination.
 
+The same successfully validated code authorizes protected document downloads
+for that role during the current page session. The browser keeps it only in a
+closure, performs a same-origin authenticated fetch, and saves the returned
+document without opening nginx's native Basic Auth dialog. Staff uses the
+`staff` username and stream `b`; management uses the `management` username and
+stream `a`. Direct URLs remain nginx-protected, cross-role fetches are rejected
+before credentials are sent, and failed authenticated downloads show an inline
+error without direct-navigation fallback. No code enters a URL, browser
+storage, public artifact, or log.
+
 ## Approved production ciphertext
 
 An indexing-enabled production build may include one owner-approved encrypted