feat(tui-go): grant scope picker (A) + standing-grants viewer

Surface the new cross-session grant scopes in the TUI.

- Approve-always (A) now opens a scope picker instead of immediately
  creating a SESSION grant: choose this session / this project / everywhere.
  SESSION stays the default (A then enter/s = old behaviour); p and g
  create PROJECT / GLOBAL grants. The grant + approval are sent on confirm
  (esc cancels, leaving the call pending).
- New "grants" palette command + G shortcut open a standing-grants viewer
  (OverlayGrants) listing the active PROJECT/GLOBAL grants — scope, tool,
  permitted tiers, project path — with x/enter to revoke. The server's
  RevokeGrant reply (a fresh grant.list) refreshes it in place.
- protocol.go: TypeGrantList + GrantDto; RevokeGrant/ListGrants encoders;
  CreateGrant now documents the wider scopes. server.go decodes grant.list
  into m.grants and treats it as a non-session global reply.
- render-matrix coverage: grant.list classified as a non-rendering query
  reply (populates the overlay, not the transcript).
- demo.go: grants + grant-scope preview kinds.

go build / vet / test green; rendered both overlays via cmd/preview.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

apps/tui-go/internal/app/demo.go

@@ -152,6 +152,30 @@ func PreviewFrame(kind string, w, h int) string {
 		m.overlay = OverlayStats
 		m.statsFor = "04a546aa"
 		m.stats = sampleStats()
+
+	case "grant-scope":
+		m.connected = true
+		m.currentModel = "llama-cpp:default"
+		m.sessions = sampleSessions()
+		m.selectedID = "04a546aa"
+		m.sessionEntered = true
+		m.grantFor = &Approval{RequestID: "req-1", SessionID: "04a546aa", Tier: "T3", ToolName: "file_write"}
+		m.grantScopeIndex = 1
+		m.overlay = OverlayGrantScope
+
+	case "grants":
+		m.connected = true
+		m.currentModel = "llama-cpp:default"
+		m.sessions = sampleSessions()
+		m.selectedID = "04a546aa"
+		m.sessionEntered = true
+		m.grants = []protocol.GrantDto{
+			{GrantID: "g-1", Scope: "GLOBAL", ToolName: "read_file", Tiers: []string{"T1", "T2"}},
+			{GrantID: "g-2", Scope: "PROJECT", ToolName: "file_write", Tiers: []string{"T3"}, ProjectID: "/home/kami/Programs/correx"},
+			{GrantID: "g-3", Scope: "GLOBAL", ToolName: "shell", Tiers: []string{"T3", "T4"}},
+		}
+		m.grantIndex = 1
+		m.overlay = OverlayGrants
 	}
 	return m.View()
 }