Authenticate through body-auth

This internal app does not validate workforce identity directly. It expects a `body-auth` HR-admin session and bootstrap, then renders only thin `body-hr` operator data.