Goal 2 foundation

Secure tenancy, identity, roles, and audit before HR features.

This shell is deliberately plain and functional. Attendance, leave, payroll, employee dashboards, and reports stay out until the foundation certification passes.