Permission-based KPI access for managers and team members

Fixed KPI access control so employees only see their own performance, managers only see direct reports, and admins retain full team visibility. Added proper backend and frontend enforcement for scoped reporting.