SSO login fix for corporate and HQ users

Corporate and HQ users whose identity tokens carry no email address and no employee code were dead-ending at login with an "account not set up" message. The resolver now derives the mailbox from the username and adds a gated fallback on the HR id, and the failure screen surfaces the user's own details in all 15 languages.

Release dependencies: production is currently on the 07-30 build, so this requires QA promoted to UAT in order to roll production, plus migration 2026-08-03-01 applied to the production database.

State: live in dev and QA.