[devSejung]

What Problem This Solves

PlatformClaw browser users need employee authentication, durable sessions, and deterministic personal-agent identity without embedding enterprise login policy in OpenClaw core.

Why This Change Was Made

Adds a control-plane employee-auth client and browser-session BFF boundary. It normalizes the legacy employee profile, derives agent IDs from account IDs, stores only hashed opaque browser tokens, enforces same-origin JSON login requests, and applies bounded idle, absolute, and concurrent-session limits.

User Impact

Employees can be authenticated through the configured company login service and mapped consistently to their PlatformClaw personal agent. This PR provides the control-plane API boundary; deployable host wiring and agent provisioning follow separately.

Evidence

• Control-plane suite: 44 passed; one Windows-only POSIX permission test skipped.
• Package declaration build passed.
• Legacy mock_employee_auth.py login roundtrip passed.
• Multiple autoreview rounds completed and accepted findings were fixed.
• Final clean autoreview rerun was blocked by the managed environment's private-code export policy; repository owner explicitly waived that final rerun.
• AI-assisted change; implementation and tests manually verified.