fix(skpd): restore taxpayer access to SKPD documents ## Changes Taxpayer accounts opening an SKPD from `/pajak-saya` reached a staff-only data reader and were denied access. The shared preview now uses a server-only document reader that permits existing dashboard access or access to the linked payment code through a taxpayer relationship or active approved tax-agent assignment. Unrelated accounts remain denied, and staff-only SKPD detail data stays restricted. Add authorization regression coverage and update the document preview fixture and its reviewed loader contracts. Fixes #1594. ## Release impact Patch. Restore the intended SKPD document preview for existing taxpayer accounts. ## Migration notes No database migration, configuration change, or user action is required. Deploy the application normally. ## Validation - Passed all five graph-contract safeguard tests and all 16 SKPD authorization/document-preview regressions. - Passed the strict full-project React Doctor audit and changed-source audit against production commit `f938d21e3fa695acc25709843d496bd73cc013e1`, with zero errors, zero warnings, and complete checks. The full audit also validated graph coverage. - Passed ESLint for all changed source and regression files, JavaScript syntax checks, and `git diff --check`. UI integration and TypeScript syntax checks passed during the original implementation. - No local build or dev server was run. Live taxpayer UI verification remains pending. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * SKPD documents can be accessed by authorized staff and users with access to the associated payment record. Access is limited when the user’s session or accepted terms do not meet requirements. * Document previews and downloads continue to use the available signed file, with missing documents handled as unavailable. <!-- end of auto-generated comment: release notes by coderabbit.ai -->