HR

Fixed and merged to dev on nuvita-hr. Worked from the ticket's description, verified each area against current code first (source audit doc confirmed permanently lost, see #137).

1. Audit events - added hand-written IAuditPublisher calls (HR's own correct pattern - it isn't on the central capture pipeline) with before/after values on manual punch, roster publish/unpublish/entries, shift template edits, and employee deactivate. Leave transitions were already fully audited from #140's work, except one real gap found and closed (ManagerApprove). All follow the exact calling convention already used elsewhere in HR.
2. Evidence document linking - confirmed the free-text evidence URL field was a genuine arbitrary-URL risk, and found the fix had actually already been half-built: a real document-upload flow existed in the portal, but the submit handler silently discarded the uploaded document id and sent the free-text URL instead. Finished wiring what was already there rather than inventing a new mechanism - the free-text field is now gone entirely, with a migration to drop the column. Flagging a pre-existing, unrelated finding: HR's document pattern (EmployeeDocument/EvidenceDocumentId) diverges from the platform's newer canonical documents-pattern.md shape, which only marks HR's adoption as "planned" - not something this fix introduced or should paper over, and directly relevant to #143 which is building toward that canonical shape.
3. ConfirmDialog - added to the 3 of 5 named actions that genuinely fired with no confirmation step at all: roster publish/unpublish, roster entry removal, and the payroll run process (split into a confirm step before executing). Employee deactivate already needed one and got it; activate (non-destructive) intentionally left as a single click, matching the platform's "destructive actions get confirmed" convention. Primary-department removal already had one from an earlier change - untouched.

Tests: HR backend unit 1331/1331 passed; HR backend integration 250/250 passed; HR frontend 105/105 files, 825/825 tests passed, type-check clean. Includes a schema migration (drops the evidence-URL column) - ordinary, safe to run normally.