List assignments (workspace-wide for admins; per-item for M holders)

Authenticate every request with Authorization: Bearer <token> — a JWT or API token.