feat(api): section save permission with document inquiries gate

Add a savePermission() contract method so a section can declare its own
save permission, granted with OR semantics against the generic update
permission - fine-grained roles can now edit only inquiries while
existing update holders keep working. Move the section-save route gate
into the controller where the per-section permission is known, register
employee.document_inquiries.update, expose a matching capability on the
employee resource, and cover all three authorization outcomes with
tests.