ci: retrigger isolated employees rebuild (bad digest from concurrent push)

The 20-service matrix push for 8a29b81 landed a digest in gitops for
employees that doesn't exist in the registry (ImagePullBackOff, confirmed
via kubectl - same failure mode documented in 512eb72/ea622a4). This commit
only touches apps/employees/ so the CI path-filter rebuilds just that one
service in isolation, avoiding the concurrent-push contention.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/employees/src/handlers/auth.rs

@@ -14,6 +14,10 @@ use serde::{Deserialize, Serialize};
 use contracts::auth_middleware::AuthUser;
 use crate::AppState;
 
+// Retrigger: force an isolated single-service rebuild of `employees` — the
+// prior concurrent 20-service push (8a29b81) landed a digest in gitops that
+// the registry doesn't actually have (same failure mode as the earlier
+// documented incident in 512eb72/ea622a4).
 pub fn router() -> Router<AppState> {
     // Includes forgot-password / reset-password against EmployeeRepository.
     Router::new()