refactor(sharing): read and judge grants from a leaf module

lib/sharing/grants.ts held both the grant transitions and the predicates
every reader asks (state, level, scope, the live grant for a pair). The
transitions reach into the managed-profile lifecycle and the OAuth connect
target, and both of those read a live grant, so grants, lifecycle and
connect-target formed an import cycle.

The predicates, findActiveGrant and touchGrantUsage move verbatim to
lib/sharing/grant-access.ts, which imports only the database client and
the scope vocabulary. Importers and the mocks that replaced those
functions point at the new module. Runtime import cycles fall from 7 to 6.

src/app/api/account/switch/route.ts

@@ -69,7 +69,7 @@ import {
   pointSessionAt,
   pointSessionAtIfUnchanged,
 } from "@/lib/sharing/acting-session";
-import { findActiveGrant } from "@/lib/sharing/grants";
+import { findActiveGrant } from "@/lib/sharing/grant-access";
 import { switchAccountSchema } from "@/lib/validations/account-sharing";
 
 export const POST = apiHandler(async (request: NextRequest) => {

src/app/api/auth/me/sessions/route.ts

@@ -38,7 +38,7 @@ import {
 } from "@/lib/auth/session";
 import { lookupIpLocation } from "@/lib/geo";
 import { GRANT_PARTY_SELECT } from "@/lib/sharing/grant-view";
-import { isGrantActive } from "@/lib/sharing/grants";
+import { isGrantActive } from "@/lib/sharing/grant-access";
 import { coarseDeviceLabel, maskIp } from "@/lib/auth/device-fingerprint";
 
 export const dynamic = "force-dynamic";