feature: doc

requester had to be

  1. editing/owner for post, delete, get
  2. viewer can get docs only

GET /api/trips/{trip_id}/documents ✅

GET /api/trips/{trip_id}/documents/{doc_id} ✅

POST /api/trips/{trip_id}/documents ✅

DELETE /api/trips/{trip_id}/documents/{doc_id}