App Platform Phase 5: add connected grant foundation

[Maneek21]

Summary

• freeze the Phase 5 connected App Protocol v1 proof contracts
• persist requested grants, dependency locks, provider snapshots, and dormant action bindings with tenant-bound database lineage
• preserve Protocol v0 compatibility and keep App-origin execution denied

Validation

• focused App Kit, grant, connector, database, upgrade, and architecture tests
• fresh disposable PostgreSQL schema and ordered extras through migration .23
• API typecheck

Local PostgreSQL uses the documented test-only vector shim because pgvector is not installed. Real-pgvector release-host certification remains Phase 5 Loop 7.