Stage 21 — Assignments API

GET /api/v1/assignments/

Protected by the existing Stage 10 bearer-token authentication.
Read-only. No database/schema changes.

Filters:
- class_id
- subject
- date (YYYY-MM-DD where supported by the legacy date value)
- limit
- offset

Pupil/student scope: own class only.
Parent scope: classes containing their children.
Admin/approved staff scope: can query assignments, optionally by class.

The legacy contents blob is not returned. The API returns has_content instead.
