Get Me

Any authenticated principal's own identity + live EFFECTIVE grant keys (registry.effective_grants: role-bound keys union direct/custom keys), so the frontend can read its own access directly instead of probing endpoints with throwaway requests to infer locks from 401/403 (PR #13's lib/access.ts). The response shape is unchanged from before roles existed (grants is still a flat list of function_key strings) — only the content is richer, so lib/access.ts's deriveSectionsFromGrants keeps working unmodified and a role-bound page now unlocks for free.

⛔THE CHAIRMAN GRANT IS APPENDED HERE, SYNTHETICALLY -- it is NOT a Constitution function key. boardroom_grants (migration 0394, leveled by 0398) is its own dedicated table by design (that migration's own header explains why); this is the one seam that folds its level into the SAME flat list the frontend already reads, so subNav.ts's existing per-item grant mechanism (Sidebar.tsx) can hide the four chairman nav items for anyone with no active grant, without inventing a second frontend gate. 'chairman:view' is present for EITHER level (write implies it can read); 'chairman:write' only for write.