refactor(sharing): read and judge grants from a leaf module

lib/sharing/grants.ts held both the grant transitions and the predicates
every reader asks (state, level, scope, the live grant for a pair). The
transitions reach into the managed-profile lifecycle and the OAuth connect
target, and both of those read a live grant, so grants, lifecycle and
connect-target formed an import cycle.

The predicates, findActiveGrant and touchGrantUsage move verbatim to
lib/sharing/grant-access.ts, which imports only the database client and
the scope vocabulary. Importers and the mocks that replaced those
functions point at the new module. Runtime import cycles fall from 7 to 6.

src/__tests__/baselines/import-cycles.json

@@ -1,6 +1,6 @@
 {
   "$comment": "Runtime import cycles under src/: the back-edge count and the strongly connected components. Maintained by src/__tests__/import-cycle-guard.test.ts.",
-  "cycles": 7,
+  "cycles": 6,
   "components": [
     [
       "components/command-palette/command-palette.tsx",
@@ -18,11 +18,6 @@
       "lib/medications/scheduling/compliance.ts",
       "lib/medications/scheduling/schedule-eras.ts"
     ],
-    [
-      "lib/integrations/oauth-kit/connect-target.ts",
-      "lib/managed-profiles/lifecycle.ts",
-      "lib/sharing/grants.ts"
-    ],
     [
       "lib/cycle/gate.ts",
       "lib/modules/gate.ts"

src/__tests__/baselines/source-file-lines.json

@@ -1,7 +1,7 @@
 {
   "$comment": "Production files over 800 lines and their length. Maintained by src/__tests__/source-size-ratchet.test.ts.",
   "count": 120,
-  "total": 141792,
+  "total": 141553,
   "entries": {
     "app/api/dashboard/summary/route.ts": 1032,
     "app/api/documents/inbound/route.ts": 811,
@@ -115,7 +115,7 @@
     "lib/polar/client.ts": 1010,
     "lib/rollups/measurement-rollups.ts": 1496,
     "lib/search/search-records.ts": 996,
-    "lib/sharing/grants.ts": 1046,
+    "lib/sharing/grants.ts": 807,
     "lib/support/report.ts": 905,
     "lib/telegram-webhook-handlers.ts": 1341,
     "lib/validations/inbound-documents.ts": 1130,

src/__tests__/baselines/version-stamp-comments.json

@@ -1,7 +1,7 @@
 {
   "$comment": "Comment lines that open with a release version, per file under src/. Maintained by src/__tests__/version-stamp-ratchet.test.ts.",
   "count": 2954,
-  "total": 10481,
+  "total": 10480,
   "entries": {
     "__tests__/account-payload-consumer-guard.test.ts": 2,
     "__tests__/acting-account-boundary-guard.test.ts": 7,
@@ -2819,7 +2819,7 @@
     "lib/sharing/audit-details.ts": 1,
     "lib/sharing/delegated-generation.ts": 1,
     "lib/sharing/grant-view.ts": 2,
-    "lib/sharing/grants.ts": 4,
+    "lib/sharing/grants.ts": 3,
     "lib/sharing/module-disclosure.ts": 1,
     "lib/sharing/record-session-fence-contract.ts": 1,
     "lib/sharing/record-session-fence.ts": 1,

src/__tests__/sharing-scope-contract.test.ts

@@ -1,6 +1,6 @@
 import { describe, expect, it } from "vitest";
 
-import { grantCoversDomain, normaliseScope } from "@/lib/sharing/grants";
+import { grantCoversDomain, normaliseScope } from "@/lib/sharing/grant-access";
 import { SHARE_DOMAINS } from "@/lib/sharing/scope";
 import { inviteGrantSchema } from "@/lib/validations/account-sharing";