## Why

The employee import (`POST /admin/employees/import`) returns failed rows in `errors[]`, and the frontend shows at most 10 of them in a popup. When many rows fail, users need a file they can fix and import again. Rebuilding that file on the frontend loses the original formatting and leading zeros, so the backend should return the uploaded file itself, reduced to the failed rows and annotated with the errors.

## What Changes

- After an import with at least one failed row, the backend builds an error file from the uploaded file:
  - Only the header row and the failed rows are kept. Successful rows and blank rows are removed.
  - Column order, headers and cell formatting are kept.
  - The "Mã NV" and "SĐT" cells are stored as text, so leading zeros are kept.
  - Two columns are added after the last header column: "Dòng gốc" (the original row number) and "Lý do lỗi" (one message per line, with wrap text on).
  - Each cell named by a reason gets a light red fill (`#FDE2E1`) and a comment with the message. A reason with no column only fills the "Lý do lỗi" cell.
  - The file is always written as `.xlsx`, even when the upload was `.xls` or `.csv`.
- The import response gains `error_file_url`. It is `null` when `errors` is empty. Otherwise it is the absolute URL of a new authenticated download endpoint. All existing fields, including `errors[]`, are unchanged.
- New endpoint `GET /admin/employees/import-errors/{id}`:
  - It requires login. It returns the file as `HRM_Employees_Import_Errors_<YYYY_MM_DD_HHmmss>.xlsx`.
  - It is allowed for the admin who ran the import, or for an admin with the `employees_info` permission who can access the import's `company_mode`.
  - It returns 404 once the file is older than 24 hours.
- A daily scheduled task deletes error files older than 24 hours.
- Importing the error file again works: the "Dòng gốc" and "Lý do lỗi" columns, fills and comments are ignored by the importer.

## Capabilities

### New Capabilities
- `employee-import-error-file`: covers generating the annotated error file after an employee import, the download endpoint with its access and expiry rules, cleanup, and re-importing the error file.

### Modified Capabilities
<!-- None in openspec/specs. The import response requirement lives in the active change fix-employee-import-position-resolution (employee-excel-import). This change adds the error_file_url field as a new requirement in its own capability instead of modifying that unarchived spec. -->

## Impact

- **Code:**
  - `EmployeeController::import` (build the file, add `error_file_url`) and a new `downloadImportErrors` action.
  - A new `App\Classes\...\EmployeeImportErrorFile` service, using PhpSpreadsheet 1.25.2 directly.
  - The blank-row check in the import, which must ignore the two added columns.
  - `app/Console/Kernel.php` (cleanup schedule).
  - `routes/v1/api_admin.php`.
- **Storage:** private files under `storage/app/employee-import-errors/`, each with a JSON metadata file next to it. No DB migration.
- **API / Frontend:** new field `error_file_url`. The frontend downloads it with the bearer token as a blob, like the existing export endpoints, not by opening a plain link.