Hide peer logins on profiles and restrict view_all to published reports.

Login stays visible only to self/manager/HR; draft report docs stay department-head only.

Co-authored-by: Cursor <cursoragent@cursor.com>

templates/partials/employee-profile-aside.html

@@ -46,11 +46,11 @@
     </div>
 
     <div style="border-top:1px solid var(--color-border); padding-top:0.875rem; margin-bottom:1rem; font-size:0.8125rem;">
+        {% if can_view_pii or is_own_profile %}
         <div style="display:flex; justify-content:space-between; gap:0.5rem; margin-bottom:0.375rem;">
             <span style="color:var(--color-muted-foreground);">{% trans "Логин" %}</span>
             <span style="font-weight:500; text-align:right; word-break:break-all;">{{ employee.username }}</span>
         </div>
-        {% if can_view_pii or is_own_profile %}
         {% if employee.email %}
         <div style="display:flex; justify-content:space-between; gap:0.5rem; margin-bottom:0.375rem;">
             <span style="color:var(--color-muted-foreground);">Email</span>