List independently accessible active families linked to a company

Firm-side family relationships only. Select the firm with x-organization-id. Owners, Admins and Staff Admins access all firm families; Staff Members need independent family assignment. Company access does not grant family access. OAuth requires the broad mcp grant, not a narrow banking scope; API keys retain ordinary agent permission scopes. No accounting organizations, portal grants, bank changes, invitations or charges are created. Writes require ordinary firm write entitlement. Cross-firm and inaccessible IDs return 404. For this company-scoped lookup, send companyId as x-organization-id; family access is still checked independently.