feature: doc
requester had to be
- editing/owner for post, delete, get
- viewer can get docs only
GET /api/trips/{trip_id}/documents ✅
GET /api/trips/{trip_id}/documents/{doc_id} ✅
POST /api/trips/{trip_id}/documents ✅
DELETE /api/trips/{trip_id}/documents/{doc_id}