identity: "apps with access" — per-subject active-grant listing (+7 tests)

identity_tokens:grants_for(Subject) lists a subject's active grants as
[{Client, Scope}] (revoked excluded), exposed through the facade as
identity:grants(Subject). Completes the per-subject account-security trio:
sessions (where logged in), grants (which apps have access), history (what
happened). New tests/account.sx. Conformance internal timeout raised to
1200s (22 suites, ~10min — run in background). 229/229.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lib/identity/conformance.sh

@@ -49,6 +49,7 @@ SUITES=(
   "introspect|id-intr-test-pass|id-intr-test-count"
   "par|id-par-test-pass|id-par-test-count"
   "dynreg|id-dyn-test-pass|id-dyn-test-count"
+  "account|id-acct-test-pass|id-acct-test-count"
 )
 
 cat > "$TMPFILE" << 'EPOCHS'
@@ -93,6 +94,7 @@ cat > "$TMPFILE" << 'EPOCHS'
 (load "lib/identity/tests/introspect.sx")
 (load "lib/identity/tests/par.sx")
 (load "lib/identity/tests/dynreg.sx")
+(load "lib/identity/tests/account.sx")
 (epoch 100)
 (eval "(list id-session-test-pass id-session-test-count)")
 (epoch 101)
@@ -135,9 +137,11 @@ cat > "$TMPFILE" << 'EPOCHS'
 (eval "(list id-par-test-pass id-par-test-count)")
 (epoch 120)
 (eval "(list id-dyn-test-pass id-dyn-test-count)")
+(epoch 121)
+(eval "(list id-acct-test-pass id-acct-test-count)")
 EPOCHS
 
-timeout 600 "$SX_SERVER" < "$TMPFILE" > "$OUTFILE" 2>&1
+timeout 1200 "$SX_SERVER" < "$TMPFILE" > "$OUTFILE" 2>&1
 
 parse_pair() {
   local epoch="$1"