test(auth): HTTP-level employee collection scoping and out-of-scope 403s