List the caller's own delegated-access grants

The caller's own OAuth grants - the consents that let an agent act on the caller's behalf - proxied from the control plane. Authenticated only: no role check, and no gateway ownership pre-fetch, because the control plane resolves "me" from the asserted bearer. A delegated caller (an agent acting for the user) is refused with a 404, because a borrowed authority must not read who else may act for the person. The control plane's { "data": [GrantRepr...] } is forwarded verbatim, where a GrantRepr is { id, client_id, actor_sub, status, created_at, expires_at, revoked_at }: id is the grant id (oauthgrant_<21>), client_id is the OAuth client the consent was granted to, actor_sub is the agent's service account acting on the user's behalf (the token's act.sub), status is one of active, revoked, or expired, and the three timestamps are RFC 3339 (revoked_at is omitted until revoked).