## Why

The employee Excel import (`POST /admin/employees/import`) derives an employee's position, department and company only from the text in the "Vị trí" column, and resolves it with `Position::findByName` (`where name = ? ->first()`). Position names are not unique across departments and companies, so two employees with the same position text but different departments or companies are both assigned the first matching position, which gives them the wrong department, company, default leader and annual-leave conversion. The import also reports failed rows only as counts, while the reasons go to the server log. Testers (TestHub TC-1497, TC-1498) cannot tell which rows failed or why, and several failures (a duplicate email in the file, a "Vị trí HĐ" over 191 characters, missing required fields) are either hidden or reported as "unknown". Neither the import endpoint nor `update-multi` checks the admin's company access.

## What Changes

- Add two optional columns to the import file: "Phòng ban" (`phong_ban`) and "Công ty" (`cong_ty`), matched by name. They narrow the position lookup.
- Resolve the position per row within the company scope. The row succeeds only when exactly one position matches. When no position matches, the row fails as "not found". When more than one matches, the row fails as "ambiguous", and the message asks the admin to fill in "Phòng ban"/"Công ty".
- Apply `company_mode` to the import. For a specific company X, positions are resolved only within X, and a row whose "Công ty" names another company fails. For `all`, the "Công ty" column is used when filled.
- **BREAKING**: Remove the silent fallback to the default "Unknown" position. A blank or unknown "Vị trí" now makes the row fail.
- Pass the resolved position to `Account::createAccount` so that it does not look the position up again by name. The leader default and the company used for annual-leave conversion come from the resolved position.
- Validate every row before inserting it: required fields; duplicate email, employee code and phone, both against the database and within the same file; string length limits (for example "Vị trí HĐ" ≤ 191 characters); and position resolution. Valid rows are still imported.
- Add an `errors` list to the import response. Each entry has the Excel row number, the employee code and the reasons. The existing count fields are kept.
- **BREAKING**: `import` and `update-multi` now call `checkCompanyAccess(company_mode)`. A request without a valid or accessible `company_mode` is rejected with 403.
- Fix the transaction handling: the import no longer calls `DB::commit()` after `DB::rollBack()`.
- Update the template `public/excels/hrm_employee_seeding.xlsx`: add the "Phòng ban" and "Công ty" columns after "Vị trí", remove the stale "Vị trí" reference sheet, and fix the misaligned data validations.

## Capabilities

### New Capabilities
- `employee-excel-import`: covers the employee Excel import: position, department and company resolution, company-mode scoping, per-row validation, per-row error reporting in the response, and the import template columns. It also covers the company-access check on the bulk update import (`update-multi`).

### Modified Capabilities
- `employee-contract-position`: the "Contract Position Default on Creation" requirement no longer assigns the default position on import when "Vị trí" is blank or unknown. That row is now rejected.

## Impact

- **Code**: `app/Http/Controllers/Api/V1/Admin/EmployeeController.php` (`import`, `updateMulti`), `app/Models/Account.php` (`createAccount` accepts a resolved `Position`), `app/Models/Position.php` (scoped lookup helper), and possibly `app/Imports/ImportWithHeading.php` (Excel row numbers).
- **API**: the import response gains `errors[]`. `company_mode` becomes enforced on `import` and `update-multi`.
- **Frontend**: it must send `company_mode` to both endpoints and show the `errors` list after an import. The import template download picks up the new columns.
- **Data**: no migration.