bf5310e489
Login stays visible only to self/manager/HR; draft report docs stay department-head only. Co-authored-by: Cursor <cursoragent@cursor.com>