feat(api): policy-driven authorization engine with site, document, and capability policies

- Engine: default-deny decisions, deny precedence, condition evaluator,
  policy validator, query translator, and resource-agnostic capability rules
- Sites domain: sites table, user/employee site_id, site-scoped employee
  visibility and edit policy (flagship site.hr role)
- Document access: route-type-aware permission mapping (employee/cv/
  questionnaire namespaces), policy-driven scope, and capabilities exposure
- Employee resource capabilities derived per actor from the engine
- Boundary arch test ensuring domains only use the Authorization contracts