feat: declarative grants DSL with compile-time verification

[C-Sinclair]

Summary

Adds a grants block to the ash_grant DSL so permissions can be declared as data rather than returned from an imperative resolver function. Each grant pairs an actor predicate (an Ash.Expr) with a set of named, structured permissions.

Before

resolver fn actor, _ ->
  case actor do
    %{role: :admin}  -> [\"post:*:*:always\"]
    %{role: :editor} -> [\"post:*:read:always\", \"post:*:update:own\"]
    %{role: :viewer} -> [\"post:*:read:published\"]
    _ -> []
  end
end

After

ash_grant do
  scope :always, true
  scope :own, expr(author_id == ^actor(:id))
  scope :published, expr(status == :published)

  grants do
    grant :admin, expr(^actor(:role) == :admin) do
      permission :manage_all, :*, :always
    end

    grant :editor, expr(^actor(:role) == :editor) do
      permission :read_all,   :read,   :always
      permission :update_own, :update, :own
    end

    grant :viewer, expr(^actor(:role) == :viewer) do
      permission :read_published, :read, :published
    end

    # Compound predicates — ABAC falls out for free
    grant :paid_editor, expr(^actor(:role) == :editor and ^actor(:plan) == :pro) do
      permission :destroy_own, :destroy, :own
    end
  end
end

What's new

• grant :name, expr(...) do ... end — predicate is an Ash.Expr over the actor, evaluated at runtime via Ash.Expr.eval/2 with Ash.Expr.fill_template/2 for ^actor(:key) substitution. Same expression machinery scopes already use — expressions all the way down.
• permission :name, :action, :scope — positional mirrors the permission string; on:, instance:, deny:, description: as keyword options.
• NormalizeGrants transformer — injects the enclosing resource as the default on:, rejects declaring both grants and an explicit resolver.
• ValidateGrantReferences verifier — compile-time checks that each permission's on: is an Ash.Resource, that action: exists on it (or is :*), and that scope: is defined in its ash_grant block.
• SynthesizeGrantsResolver + AshGrant.GrantsResolver — when grants are declared, wires GrantsResolver as the resource's resolver. Check, FilterCheck, and Explainer pick it up unchanged.
• Introspection — Info.grants/1, Info.get_grant/2, Info.permissions/1.

Why

• Inspectable, diffable security config — grants become data a reviewer can scan top-to-bottom; the resolver becomes generated.
• Compile-time safety — renaming an action or deleting a scope breaks compilation, not runtime.
• Expressions all the way down — ^actor(:key) in a grant predicate works the same way it does in a scope, with the same evaluation machinery.

Scope of this PR

Resource-level grants only. Explicitly deferred:

• purpose / purposes compliance metadata — removed from this PR; needs deeper design before shipping.
• Domain-level grants block and dedicated use AshGrant.Grants module form — sensible follow-ups.
• Declarative deny rules combined with allow rules for the same action — the resolver emits the ! prefix correctly, but there appears to be a Check evaluation subtlety when an allow-grant and deny-grant match the same action for the same actor. A standalone deny grant works; a deny grant alongside a sibling allow grant needs a separate look. Deny-wins semantics for declared grants will be its own follow-up PR.
• expr() predicates inside conditional grant nesting — no intentional constraints, but worth a broader coverage pass with complex actors.

Grants and an explicit resolver are mutually exclusive — for runtime instance-specific grants (DB-backed per-row shares) keep using the resolver function escape hatch.

Test plan

DSL tests (test/ash_grant/grants_dsl_test.exs, 19 tests):

• Grant + permission parsing, :on injection, :instance override, deny flag
• Synthesized resolver emits correct permission strings for admin / editor / viewer / nil / unknown / specific-instance / compound-predicate actors
• Actor missing predicate fields yields []
• Missing resource in context yields []
• Rejects grants + explicit resolver with a Spark.Error.DslError
• Rejects removed purpose: keyword with a schema error

Integration tests (test/ash_grant/grants_integration_test.exs, 17 tests — AshPostgres + Ash.Policy.Authorizer):

• Reads: admin sees all, editor sees all via :always, viewer only sees :published, stranger denied, nil actor denied
• Creates: admin ✓, editor ✓, viewer ✗, stranger ✗
• Updates: editor can update own, editor cannot update other's (scope :own narrows), admin can update anything
• Compound predicate: free editor ✗ destroy, pro editor ✓ destroy own draft, pro editor ✗ destroy other's (scope :own)
• Resolver identity: resource wired to GrantsResolver; emits expected permission strings per role

Full suite: 1091 tests, 1 pre-existing failure unrelated to this PR (default_field_policies_test.exs).

Credo: mix credo --strict clean on all new files.