fix(auth): scope employee document lists and org-chart export by role rules