refactor(sharing): read and judge grants from a leaf module

lib/sharing/grants.ts held both the grant transitions and the predicates
every reader asks (state, level, scope, the live grant for a pair). The
transitions reach into the managed-profile lifecycle and the OAuth connect
target, and both of those read a live grant, so grants, lifecycle and
connect-target formed an import cycle.

The predicates, findActiveGrant and touchGrantUsage move verbatim to
lib/sharing/grant-access.ts, which imports only the database client and
the scope vocabulary. Importers and the mocks that replaced those
functions point at the new module. Runtime import cycles fall from 7 to 6.

tests/integration/account-grant-lifecycle.test.ts

@@ -31,13 +31,15 @@ import { encrypt } from "@/lib/crypto";
 import {
   GrantError,
   acceptGrant,
-  findActiveGrant,
-  grantAllows,
   inviteGrant,
   renounceGrant,
   revokeGrant,
-  touchGrantUsage,
 } from "@/lib/sharing/grants";
+import {
+  findActiveGrant,
+  grantAllows,
+  touchGrantUsage,
+} from "@/lib/sharing/grant-access";
 
 import { cookieJar, headerJar } from "./mock-next-headers";
 import { getPrismaClient, truncateAllTables } from "./setup";

tests/integration/managed-profile-lifecycle.test.ts

@@ -4,11 +4,8 @@ import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import { cookieJar, headerJar, queuedSessionIds } from "./mock-next-headers";
 import { getPrismaClient, truncateAllTables, switchSessionTo } from "./setup";
 import { createManagedProfile } from "@/lib/managed-profiles/create";
-import {
-  acceptGrant,
-  findActiveGrant,
-  inviteGrant,
-} from "@/lib/sharing/grants";
+import { acceptGrant, inviteGrant } from "@/lib/sharing/grants";
+import { findActiveGrant } from "@/lib/sharing/grant-access";
 import {
   clearManagedProfileMarker,
   ManagedProfileLifecycleError,

tests/integration/sharing-scope-routes.test.ts

@@ -1,11 +1,8 @@
 import { beforeEach, describe, expect, it } from "vitest";
 
 import { getPrismaClient, truncateAllTables } from "./setup";
-import {
-  acceptGrant,
-  grantCoversDomain,
-  inviteGrant,
-} from "@/lib/sharing/grants";
+import { acceptGrant, inviteGrant } from "@/lib/sharing/grants";
+import { grantCoversDomain } from "@/lib/sharing/grant-access";
 import { SHARE_DOMAINS } from "@/lib/sharing/scope";
 
 let counter = 0;