Refactor to use named authorization policies in controllers

Replaced direct role-based [Authorize] attributes with named
authorization policies (e.g., AuthPolicy.Receiver,
AuthPolicy.SenderOrReceiver) in AnnotationController,
DocumentController, and ReadOnlyController. Added and registered
new policies in Program.cs and updated AuthPolicy constants.
This centralizes and simplifies authorization management.

EnvelopeGenerator.API/Controllers/ReadOnlyController.cs

@@ -37,7 +37,7 @@ public class ReadOnlyController : ControllerBase
     /// </summary>
     /// <param name="createDto">Creation payload.</param>
     [HttpPost]
-    [Authorize(Roles = Role.Receiver.FullyAuth)]
+    [Authorize(Policy = AuthPolicy.Receiver)]
     public async Task<IActionResult> CreateAsync([FromBody] EnvelopeReceiverReadOnlyCreateDto createDto)
     {
         var authReceiverMail = User.GetReceiverMailOfReceiver();