feat(grants): add DELETE /v1/grants/{grantId} for owner-driven revocation

[tnunamak]

Summary

Adds the missing companion to POST /v1/grants. Owner can now revoke a grant by id without producing a wallet popup; PS signs GrantRevocation EIP-712 with its delegated serverSigner and submits to the gateway.

Why

Account-app-driven flows (e.g. account.vana.org's account-action revocation UI in PR vana-com/vana-connect#112) need a programmatic revoke path that does not invoke a user wallet popup at revoke time. PS already exposes POST /v1/grants for the create side; this is the symmetric delete side.

Behavior

• Auth: owner-only (Web3Signed by serverOwner, Bearer access token, or dev token — same model as POST /).
• Signs GrantRevocation { grantorAddress, grantId } via serverSigner.signGrantRevocation.
• Calls gateway.revokeGrant({ grantId, grantorAddress, signature }).
• Returns { status: 'revoked', grantId } on success.
• 502 on gateway error; 500 if signer is not configured.

Tests

• happy path verifies signer + gateway calls
• gateway error returns 502
• missing serverSigner returns 500

packages/server/src/routes/grants.test.ts — 18 pass / 0 fail.

Scope

Single route added. No middleware changes. No changes to existing routes. No client-side changes (gateway client already exposes revokeGrant).

[github-actions]

Codex Review

Findings

• packages/server/src/routes/grants.ts:251: grantId is only checked for presence, then cast to 0x${string} and signed as EIP-712 bytes32. Malformed path values like /v1/grants/not-a-bytes32 will fail inside signing and return 500 GRANT_REVOCATION_SIGN_FAILED, even though this is client input. Validate as bytes32 first, for example 0x + 64 hex chars or viem isHex(..., { size: 32 }), return 400, and add a test that signer/gateway are not called.

Verification

I attempted to run pnpm test -- packages/server/src/routes/grants.test.ts, but pnpm is not installed. I also tried npm test -- packages/server/src/routes/grants.test.ts, but local dependencies are missing (vitest: not found).