feat(api): add effective-permission and check APIs with employee linkage payloads

- GET /auth/me/authorization returns active role + resolved permission map
  with deny precedence (AuthorizationService::effectivePermissions)
- POST /authorization/check evaluates permission/policy against acting user,
  resolving resources by type via AttributeRegistry::modelForResourceType
- expose linked employee in auth/me, profile, role chart, cv reviewer payloads
- user avatar serves via relative temporary signed URL; drop scopeOwn ability