Enforce asset activity document permissions

Direct document and API access to Asset Activity now respects the linked Asset's company restriction, matching the list and report.