Replaced direct role-based [Authorize] attributes with named authorization policies (e.g., AuthPolicy.Receiver, AuthPolicy.SenderOrReceiver) in AnnotationController, DocumentController, and ReadOnlyController. Added and registered new policies in Program.cs and updated AuthPolicy constants. This centralizes and simplifies authorization management.