fix(portal): preserve readable download filenames

www/integrations/employee-portal/README.md

@@ -13,7 +13,9 @@ document without opening nginx's native Basic Auth dialog. Staff uses the
 stream `a`. Direct URLs remain nginx-protected, cross-role fetches are rejected
 before credentials are sent, and failed authenticated downloads show an inline
 error without direct-navigation fallback. No code enters a URL, browser
-storage, public artifact, or log.
+storage, public artifact, or log. Downloads use a bounded safe form of the
+approved link label and preserve the validated extension from the protected
+SHA-256 server destination; server resources are not renamed.
 
 ## Approved production ciphertext