feat(federation): grants service CRUD + status transitions (FED-M2-06)

- Add 'pending' to grantStatusEnum (pending → active → revoked/expired)
- Update federationGrants default status to 'pending'
- Add migration 0009_federation_grant_pending.sql
- GrantsService: createGrant, getGrant, listGrants, activateGrant, revokeGrant, expireGrant
- Invalid transitions throw ConflictException; missing grants throw NotFoundException
- CreateGrantDto validates scope via parseFederationScope before insert
- Full unit test coverage for all status transitions and edge cases

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

packages/db/drizzle/meta/_journal.json

@@ -64,6 +64,13 @@
       "when": 1776822435828,
       "tag": "0008_smart_lyja",
       "breakpoints": true
+    },
+    {
+      "idx": 9,
+      "version": "7",
+      "when": 1745280000000,
+      "tag": "0009_federation_grant_pending",
+      "breakpoints": true
     }
   ]
 }