chore: render-time program filter for case_detail sections (move section_applies_to_program to canopy-composition per ADR-007)

section_applies_to_program shipped in canopy-web in Stage 5 MR4 (#497 (closed)). Per ADR-007 (CLI/API/UI parity), filter logic should live in canopy-composition so the CLI canopy composition resolve surface gets the same filtering.

Scope:

• Move section_applies_to_program helper from services/canopy-web/src/case_detail/util.rs to crates/canopy-composition/src/role_filter.rs (or sibling).
• Update canopy-web import.
• No behavior change.

Tracking origin: Stage 5 MR4 (#497 (closed)) descope. Refs &51.