feat: add deterministic upstream grant pools

[steipete]

Summary

• add policy/tenant same-provider grant pools with deterministic numeric priority and stable tie-breaking
• serialize bounded membership in the access authority and bulk-fetch secret-bearing records in one KV operation
• preserve provider-id default grants without migration; validate new pool key segments and reject overflow before storage
• expose priority in the admin API/console and carry it through browser OAuth

Proof

• pnpm check
• pnpm build
• pnpm worker:e2e
• pnpm --dir admin test:browser
• autoreview: clean after two repair cycles (0.90 confidence)

Deployment

• not deployed; merge first, then quota feedback/failover follows in a separate PR

Remaining risk

• live quota signals and same-provider retry are intentionally the next stacked behavior change; this PR establishes only selection and control-plane membership