feat(portal): add service drawers and employee portal preview

www/reports/SESSION_HANDOFF.md

@@ -1,9 +1,9 @@
 # AIA Astro Migration — Living Session Handoff
 
-**Last updated:** October 29, 2026 (UTC)
+**Last updated:** October 30, 2026 (UTC)
 **Repository:** `AIAMarketing/azinstitute4autism.com`
 **Working branch:** `faithful-astro-migration`
-**Last accepted technical implementation:** Phase 9 bounded landing-page integration (presentation and inactive lead UI only; human decisions and production activation pending)
+**Last accepted technical implementation:** Phase 9 isolated consultation integration at `ff80ee516f0185023af1f29937e29dfb30d31f47`; this handoff also describes the consolidated service-drawer and employee-portal checkpoint candidate
 **Previous accepted checkpoint:** P9-03 documentation, signed `537f9864a0a3d0806180cbeca909bf1d03200c6f`
 **Implementation checkpoint:** the commit containing this handoff update; obtain its actual SHA from Git history after the user creates the signed commit.
 **Next milestone:** continue Phase 9 owner decisions and authorized integration batches; then Phase 10 — Final QA/Cutover Readiness.
@@ -374,3 +374,30 @@ The old `.phase7-stage-paths.nul` is absent; do not recreate it.
 The staging aid is for the user's host terminal only; never stage it or use a
 broad Git add. The actual future checkpoint SHA comes from Git after the user
 signs; do not amend merely to insert it here.
+
+## Consolidated service drawers and portal checkpoint, 2026-10-30
+
+This section supersedes earlier explicit-only drawer behavior. The checkpoint
+containing this update adds four-second/50%-scroll consultation opening, one
+shared 30-day localStorage expiry preference, manual override through the six
+existing EN/ES service CTAs, and typed bilingual service introductions. The
+Academy configuration is prepared without a new page. The fixed seven production
+and separate nine consultation-test route lists remain unchanged. Consultation
+indexing approval must explicitly be `false`.
+
+The employee route now has a locked, local-decryption UI and a private owner-run
+collection/rewrite utility. Real passphrases were unavailable: real portal
+content/resource inventory and collection remain blocked pending the owner-run
+step. Do not claim approximately 43 resources as a measured inventory. Do not
+commit the original source, ciphertext, decrypted views or private resources.
+`www/private/employee-portal/` is ignored and outside Astro public output.
+The accepted Jotform CSS backup and reconciliation archives are unchanged.
+
+SOPS/age/sops-nix preparation is inactive, with no generated production identity,
+recipient, deployed module or server-access activation. Portal browser encryption
+remains access friction; internal resources require separate server-enforced
+staff/management authorization. See
+[consolidated implementation and validation](phase-9-service-portal-consolidated-2026-10-30.md)
+and [owner utility instructions](../integrations/employee-portal/README.md).
+The actual checkpoint SHA is the commit containing this section; obtain it from
+Git history. No push, deployment or cutover is authorized by this work.