feat(api): enforce resource-level authorization on employee document endpoints