feat(perms): add documents.manage_folders permission

Mirrors files.manage_folders. Gates create / rename / move / delete
of document folders, plus moving documents between folders. Reps with
documents.edit but not manage_folders can rename docs in place but
can't reorganise the tree. Admin + sales_manager get the perm by
default; sales_rep + viewer don't.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/helpers/factories.ts

@@ -321,6 +321,7 @@ export function makeFullPermissions(): RolePermissions {
       send_for_signing: true,
       upload_signed: true,
       delete: true,
+      manage_folders: true,
     },
     expenses: {
       view: true,
@@ -401,6 +402,7 @@ export function makeViewerPermissions(): RolePermissions {
       send_for_signing: false,
       upload_signed: false,
       delete: false,
+      manage_folders: false,
     },
     expenses: {
       view: true,
@@ -481,6 +483,7 @@ export function makeSalesAgentPermissions(): RolePermissions {
       send_for_signing: true,
       upload_signed: true,
       delete: false,
+      manage_folders: false,
     },
     expenses: {
       view: true,
@@ -561,6 +564,7 @@ export function makeSalesManagerPermissions(): RolePermissions {
       send_for_signing: true,
       upload_signed: true,
       delete: true,
+      manage_folders: true,
     },
     expenses: {
       view: true,