Add permission check for `get_company_defaults`

API endpoint now checks user permissions before returning company defaults.