feat(api): lock down document serving behind auth and grants

Serve employee documents only to authenticated users holding the
download permission, and guard cv and questionnaire serving with a
new grant.serve middleware that accepts an HR view permission, a
header access token covering the view, or a session-bound grant
token issued at OTP verification for embeddable clients. Payloads
switch from signed URLs to plain relative routes, gain ascii name
slugs on cv, questionnaire, and employee payloads, and thumbnail
appends use proper query separators.