[Story-735] Support access grants frontend list + revoke

sequenceDiagram
  autonumber
  participant browser as Browser
  participant server as Server
  participant gateway as Gateway
  browser->>server: load /settings/firm/grants
  server->>gateway: list grants (schema-validated)
  gateway->>server: grants payload
  server->>browser: list / empty / error
  browser->>browser: click revoke → confirm
  browser->>server: revoke action (firm-admin only)
  server->>gateway: revoke grant (schema-validated)
  server->>browser: list refreshes