feat(client): capability-driven employee actions and per-action document gating

- Employee edit/delete buttons and row edit pencil derive from the
  backend capabilities block instead of permission names
- Document section gates trash and upload per backend capability