Enforce per-role export permission on query download

Fixes RBAC enforcement on query downloads by checking the DocPerm export bit; previously only checked global settings and team membership, rendering Role Permissions Manager's role-level toggle ineffective.