feat(api): enforce resource-level authorization on role, user, document-category, and form-options endpoints