Returns a paginated list of card issuing requests for the company. A card
issuing request is what the dashboard creates when a user asks for a card:
it captures the requested budget, interval, and (for physical cards) the
shipping details, and is later approved by Cardda — producing the actual
VendorCard and setting vendor_card_id.

Authorization is index? = admin? || in_company?. A non-admin caller
must therefore resolve a company they belong to — supplied via the
company-id header (or a company_id query param). With neither present the
caller has no company membership, fails the gate, and the request returns
401. Admins bypass the gate.

Once authorized, the result is scoped per-caller via policy_scope. That
scope is not limited to the resolved company: it spans every company where
the caller holds the card_issuing_requests_manage permission, plus the
caller's own requests. Roles within that scope:

• Admins see every request.
• Managers (card_issuing_requests_manage permission) see every request
  of the companies they manage.
• Regular users see only their own requests (user_id matches their Firebase
  user id).

Each row includes the computed fields kyc_completed (whether the company
finished KYC) and shipping_municipality_name (municipality resolved from
the shipping address).

All operators in Filters are supported
on the columns below.