Restrict transaction document attachments to authorized roles.
Acceptance Criteria:
- Attachment access checks ownership and role permissions.
- Unauthorized users cannot retrieve or download attachments.
- Access control is enforced on upload, download, and listing endpoints.
- Tests cover agent, user, and admin permission paths.
Restrict transaction document attachments to authorized roles.
Acceptance Criteria: