feat(api): enforce resource-level authorization on employee endpoints