feat(canopy-enrollment): household-scope RBAC for issuance listing

Source: canopy-enrollment-household-issuances plan Potential Improvements.

The household-scoped issuance listing (GET /v1/households/{id}/issuances) currently requires eligibility_specialist_or_above, the same role used for enrollment-scoped listing. Household-centric views may eventually want a narrower "own caseload only" RBAC scope so a worker can read their assigned households without seeing unrelated cases.

Acceptance: new role eligibility_specialist_own_caseload; route guard checks worker_id against caseload assignment; existing tests still pass for the broader role.