chore(employees): retrigger isolated CI build

The prior push (crates/cache change) rebuilt all 20 workspace services
concurrently, and the employees job's build/push landed a digest that
doesn't exist in the registry (kubectl confirmed ImagePullBackOff with
"not found" resolving that exact sha256). This commit only touches
apps/employees/ so the CI path-filter rebuilds just that one service in
isolation, without the same concurrent-build congestion.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/employees/src/handlers/auth.rs

@@ -15,6 +15,7 @@ use contracts::auth_middleware::AuthUser;
 use crate::AppState;
 
 pub fn router() -> Router<AppState> {
+    // Includes forgot-password / reset-password against EmployeeRepository.
     Router::new()
         .route("/login",           post(login))
         .route("/logout",          post(logout))