identity: "apps with access" — per-subject active-grant listing (+7 tests)

identity_tokens:grants_for(Subject) lists a subject's active grants as
[{Client, Scope}] (revoked excluded), exposed through the facade as
identity:grants(Subject). Completes the per-subject account-security trio:
sessions (where logged in), grants (which apps have access), history (what
happened). New tests/account.sx. Conformance internal timeout raised to
1200s (22 suites, ~10min — run in background). 229/229.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lib/identity/scoreboard.json

@@ -1,7 +1,7 @@
 {
   "language": "identity",
-  "total_pass": 222,
-  "total": 222,
+  "total_pass": 229,
+  "total": 229,
   "suites": [
     {"name":"session","pass":11,"total":11,"status":"ok"},
     {"name":"token","pass":24,"total":24,"status":"ok"},
@@ -23,6 +23,7 @@
     {"name":"exchange","pass":8,"total":8,"status":"ok"},
     {"name":"introspect","pass":9,"total":9,"status":"ok"},
     {"name":"par","pass":7,"total":7,"status":"ok"},
-    {"name":"dynreg","pass":5,"total":5,"status":"ok"}
+    {"name":"dynreg","pass":5,"total":5,"status":"ok"},
+    {"name":"account","pass":7,"total":7,"status":"ok"}
   ]
 }