Keep payroll storage to the worker subnet

Payroll exports now run on isolated workers in a dedicated subnet, but the storage account still accepts connections from every network. The workers must keep reaching the account while unrelated networks are excluded.

Repair payroll-storage.json so payrollexports accepts service-endpoint traffic only from payroll-workers.

• Keep publicNetworkAccess enabled for that path and preserve the supplied address ranges, HTTPS/TLS safeguards, and disabled shared-key access.
• Permit no IP exceptions, resource exceptions, trusted-service bypass, or additional subnets.