fix: enforce registered authorization permissions

Two related fail-closed gaps let a well-formed but never-declared
permission id slip through:

- POST /api/v1/grants created explicit grants for any well-formed
  PermissionId without checking the injected permission registry,
  allowing dormant grants for invented identifiers that could become
  effective the moment those identifiers were registered later.
- createAuthorizationEvaluator validated the permission id only inside
  the restricted-baseline branch, so a malformed permission combined
  with the public or authenticated baseline could still return allowed.

Both now fail closed: the grants route checks the target permission
against the trusted registry before calling store.createGrant (sanitized
403, no store or audit write), and the evaluator validates permission
shape before any baseline is allowed to return an allowed decision,
without adding a registry dependency to the evaluator itself.

The live integration lifecycle test switched from an unregistered
calendar.events.read to the registered core.authorization.grants.manage
permission, since module permission registration does not exist yet.

apps/api/src/grants-routes.ts

@@ -164,6 +164,16 @@ export function createGrantsRoutes(options: CreateGrantsRoutesOptions): Hono {
       return c.json({ code: "INVALID_REQUEST" }, 400);
     }
 
+    // A well-formed PermissionId is not necessarily a *registered* one. Only the trusted registry
+    // (never the request) decides what may be granted — the same registry `requireManagePermission`
+    // already consults for the caller's own `core.authorization.grants.manage` check — so a caller
+    // cannot pre-create a dormant grant for an invented identifier that later becomes effective the
+    // moment someone registers it. Sanitized identically to any other denial: this must never reveal
+    // whether the identifier was malformed (400, above) or simply unregistered (403, here).
+    if (!options.registry.has(parsed.permission)) {
+      return c.json({ code: "AUTHORIZATION_DENIED" }, 403);
+    }
+
     try {
       const grant = await options.store.createGrant({
         actor: createUserActor(principal.userId),