feat(federation): grants service CRUD + status transitions (FED-M2-06) (#496)

packages/db/src/schema.ts

@@ -604,11 +604,12 @@ export const peerStateEnum = pgEnum('peer_state', ['pending', 'active', 'suspend
 
 /**
  * Lifecycle state of a federation grant.
+ * - pending: created but not yet activated (awaiting cert enrollment, M2-07)
  * - active:  grant is in effect
  * - revoked: manually revoked before expiry
  * - expired: natural expiry (expires_at passed)
  */
-export const grantStatusEnum = pgEnum('grant_status', ['active', 'revoked', 'expired']);
+export const grantStatusEnum = pgEnum('grant_status', ['pending', 'active', 'revoked', 'expired']);
 
 /**
  * A registered peer gateway identified by its Step-CA certificate CN.
@@ -696,7 +697,7 @@ export const federationGrants = pgTable(
     scope: jsonb('scope').notNull(),
 
     /** Current grant lifecycle state. */
-    status: grantStatusEnum('status').notNull().default('active'),
+    status: grantStatusEnum('status').notNull().default('pending'),
 
     /** Optional hard expiry. NULL means the grant does not expire automatically. */
     expiresAt: timestamp('expires_at', { withTimezone: true }),