Fix empty org canvas, editable Studio reserve agents, and org/collab sync

[XYAIStudio]

Summary

Empty business-space orgs and Studio-pushed agents were unusable: the org canvas had no empty-state create path, deep nesting was effectively hidden, reserve/Studio agents could not be edited, and assigning a department did not keep 组织架构 and 沟通协作 in sync.

This change extends the existing org/employee APIs (no parallel talent model):

• 组织架构 canvas: empty orgs can create a root department on the canvas; child departments nest without a depth cap; employees can be added to a department from the canvas (new hire or from 备选员工).
• 备选员工: Studio-pushed agents are editable (name, role/title, department, description, skills) and can be matched to a department.
• Sync: department assignment updates both 组织架构 and 沟通协作 through a shared workforce store revision (no full page reload).

Demo login / tenant seed is unchanged.

Studio interop contract (for XYAI Studio components/openxyos)

POST /api/xyai/agents/import is the Studio → 备选员工 path.

Headers

• Authorization: Bearer <tenant JWT>
• X-XYAI-Interop: studio (required)

Body (aliases accepted so Studio can keep current field names)

• name (required)
• role or title
• description (optional positioning / industry are folded in when description is empty)
• department / department_name (exact tenant name match) or department_id
• agent_type
• skills (string or string[])
• capabilities (string or string[])
• avatar_emoji
• employee_type (ai default, or human)
• external_id / source_id / studio_id (idempotency key)

Result

• Writes talent_pool (source=studio) and an employees row with employment_category=reserve.
• Re-import with the same external_id updates the same reserve employee (no duplicate).
• If a department is already matched, the agent also appears on 组织架构 / 沟通协作.

If Studio needs an additional payload field, mirror it into the parent components/openxyos submodule using the aliases above.

Security and data impact

• Import is tenant-scoped via the authenticated JWT; missing/invalid interop header is 403.
• Cross-tenant reads of imported employees return 404.
• Additive SQLite columns only: talent_pool.external_id, employees.source.
• CORS now allows X-XYAI-Interop and Accept-Language.
• Department create remains admin-only. Demo seed is not modified.

Verification

Ran after opening this draft:

npm run test:org-talent-ux
npm run test:agent-studio
npm run lint
npm run typecheck
npm run i18n:check
npm run verify:open-source

All of the above passed. Browser click-through of 组织架构 / 备选员工 / 沟通协作 was not run in this environment (no seeded demo login).

Checklist

• No credentials, customer data, runtime databases, uploads, logs, or build artifacts are included.
• Tests cover changed behavior and relevant failure paths.
• User-visible changes include both zh-CN and en copy.
• npm run verify:open-source passed.
• Every commit has a DCO Signed-off-by line.