feat(portal): add service drawers and employee portal preview

www/reports/employee-portal-migration-brief-2026-10-08.md

@@ -153,3 +153,26 @@ This is **documentation only**. It must not change Phase 3A publication policy,
 Phase 3B hreflang implementation, Astro routing, production access, forms,
 analytics, or server configuration. It does not claim authentication,
 HIPAA compliance, or release readiness.
+
+## 2026-10-30 owner authorization and implementation addendum
+
+The owner explicitly authorized the two-stream browser-encrypted compatibility
+model for development, superseding the earlier implementation hold for that
+bounded scope. Production authorization and server-side resource protection are
+still unresolved. The new scoped EmployeePortal component preserves the existing
+route/SEO policy, local password entry, HMAC verification before decryption,
+locked/unavailable default and passive content rendering.
+
+The read-only source is at
+`/home/alice/projects/wrk/aia/local-archives/aia-employee-portal-hubspot-footer-source.txt`.
+Its two-stream structure and algorithm were inspected without exposing ciphertext
+or plaintext. Legitimate codes were not available to the agent. Real-view
+fidelity and exact resource counts remain blocked, not accepted. No real document
+was fetched or published. The owner-run migration utility performs private
+collection and approved link rewriting/re-encryption; see
+[private workflow instructions](../integrations/employee-portal/README.md).
+
+SOPS/age/sops-nix templates are prepared but inactive. Encryption of deployment
+secrets does not authorize public delivery of staff/management documents. The
+[consolidated report](phase-9-service-portal-consolidated-2026-10-30.md) records
+synthetic tests and the separate remaining owner/cutover gates.