Security: Replace browser alert credential exposure with email delivery for approved staff

[coderabbitai]

Summary

When a pending employment form is approved, the approval handler in src/main/resources/static/js/employment.js (around lines 226–230) displays the raw server response text in a browser alert(). This response may include a generated password, exposing credentials directly in the client UI.

Current Behavior

const text = await res.text();
if (res.ok) {
    alert("Godkänd!\n" + text);
    ...
}

Expected Behavior

• Generated credentials (passwords) should never be surfaced in a browser alert.
• Implement a secure email delivery mechanism to send credentials directly to the new staff member.
• The approval handler should only display a generic success notification (e.g. "Godkänd!") without including any server response text that may contain sensitive data.

Plan

Replace the alert("Godkänd!\n" + text) call with a simple success notification and implement an email service to deliver credentials securely to the newly approved staff member.

References

• PR: Feature/employment #81
• Review comment: Feature/employment #81 (comment)
• Reported by: @codebyNorthsteep