fix: enforce registered authorization permissions

Two related fail-closed gaps let a well-formed but never-declared
permission id slip through:

- POST /api/v1/grants created explicit grants for any well-formed
  PermissionId without checking the injected permission registry,
  allowing dormant grants for invented identifiers that could become
  effective the moment those identifiers were registered later.
- createAuthorizationEvaluator validated the permission id only inside
  the restricted-baseline branch, so a malformed permission combined
  with the public or authenticated baseline could still return allowed.

Both now fail closed: the grants route checks the target permission
against the trusted registry before calling store.createGrant (sanitized
403, no store or audit write), and the evaluator validates permission
shape before any baseline is allowed to return an allowed decision,
without adding a registry dependency to the evaluator itself.

The live integration lifecycle test switched from an unregistered
calendar.events.read to the registered core.authorization.grants.manage
permission, since module permission registration does not exist yet.

apps/api/tests/grants-routes.test.ts

@@ -9,6 +9,7 @@ import {
   type AuthorizationEvaluator,
   type AuthorizationStore,
   AuthorizationStoreError,
+  CORE_AUTHORIZATION_GRANTS_MANAGE,
   CORE_PERMISSION_REGISTRY,
 } from "@ekklesia/core/authorization";
 import type { EkklesiaIdentityRuntime } from "@ekklesia/core/identity";
@@ -20,7 +21,13 @@ const trustedOrigin = "https://dashboard.example.test";
 const untrustedOrigin = "https://evil.example.test";
 const manager = createAuthenticatedPrincipal("manager_1");
 const subjectUserId = parseEkklesiaUserId("subject_1");
+// Well-formed but never declared in `CORE_PERMISSION_REGISTRY` — used to prove the routes reject
+// (or, for listing, still return) an unregistered permission id rather than assuming registration.
 const permission = parsePermissionId("calendar.events.read");
+// A permission `CORE_PERMISSION_REGISTRY` actually declares, so tests that must reach
+// `store.createGrant`/`store.revokeGrant` can do so without also depending on module permission
+// registration, which does not exist yet.
+const registeredPermission = CORE_AUTHORIZATION_GRANTS_MANAGE;
 const grantId = parseGrantId("11111111-1111-1111-1111-111111111111");
 
 function fakeRuntime(overrides: Partial<EkklesiaIdentityRuntime> = {}): EkklesiaIdentityRuntime {
@@ -170,7 +177,7 @@ describe("POST /api/v1/grants", () => {
     const createdGrant = {
       createdAt: new Date("2026-01-01T00:00:00.000Z"),
       id: grantId,
-      permission,
+      permission: registeredPermission,
       scope: parseAuthorizationScope("calendar-event:123"),
       sourceKind: "explicit" as const,
       userId: subjectUserId,
@@ -179,7 +186,11 @@ describe("POST /api/v1/grants", () => {
     const { app } = buildApp({ store });
 
     const response = await app.request("/api/v1/grants", {
-      body: JSON.stringify({ permission, scope: "calendar-event:123", subjectUserId }),
+      body: JSON.stringify({
+        permission: registeredPermission,
+        scope: "calendar-event:123",
+        subjectUserId,
+      }),
       headers: { "content-type": "application/json", origin: trustedOrigin },
       method: "POST",
     });
@@ -190,7 +201,7 @@ describe("POST /api/v1/grants", () => {
     expect(store.createGrant).toHaveBeenCalledWith(
       expect.objectContaining({
         actor: { type: "user", userId: manager.userId },
-        permission,
+        permission: registeredPermission,
         scope: "calendar-event:123",
         sourceKind: "explicit",
         userId: subjectUserId,
@@ -198,6 +209,20 @@ describe("POST /api/v1/grants", () => {
     );
   });
 
+  it("rejects a well-formed but unregistered permission with the same sanitized denial as an unauthorized caller, and never calls the store", async () => {
+    const { app, store } = buildApp({});
+
+    const response = await app.request("/api/v1/grants", {
+      body: JSON.stringify({ permission, subjectUserId }),
+      headers: { "content-type": "application/json", origin: trustedOrigin },
+      method: "POST",
+    });
+
+    expect(response.status).toBe(403);
+    expect(await response.json()).toEqual({ code: "AUTHORIZATION_DENIED" });
+    expect(store.createGrant).not.toHaveBeenCalled();
+  });
+
   it.each([
     "actor",
     "owner",
@@ -256,7 +281,7 @@ describe("POST /api/v1/grants", () => {
     const { app } = buildApp({ store });
 
     const response = await app.request("/api/v1/grants", {
-      body: JSON.stringify({ permission, subjectUserId }),
+      body: JSON.stringify({ permission: registeredPermission, subjectUserId }),
       headers: { "content-type": "application/json", origin: trustedOrigin },
       method: "POST",
     });