feat(api): protect questionnaire management with permission middleware