ERP-5865 — workers' comp codes for the caller's staffing company. The route already existed at GET /v1/CompanySettings/workersCompCodes, but that one is [Authorize] (user JWT), so the HMAC integration principal could never call it and the WORKERS_COMP_CODE feed had never populated a single row. Re-exposing it here puts it on the same signed footing as every other ERP2 lookup instead of widening the JWT endpoint's auth. Same MediatR query the JWT controller uses, so there is one implementation, not two.