m8.2: Global cube grants and explicit deny

Extends the cube authorization model (ADR-0016) with a global (all-cubes) grant scope and explicit deny, so broad baseline access with per-cube exceptions is now expressible for users and groups, on top of the closed-by-default posture from m8.1.

What's new

• Global cube grants. Grant a user or group a baseline level (read/write/admin) across every cube in one grant, instead of one grant per cube. A newly created cube is covered automatically.
• Explicit deny. Deny a user or group on a specific cube, or across all cubes, as a carve-out from a broader allow.
• Predictable precedence. Most-specific tier wins (a per-cube grant overrides a global one), an explicit deny wins within its tier, and an admin always has full access (a deny never locks out an admin). The deployment default posture (closed by default) remains the floor.

Example: give the analysts group read on all cubes, write on Budget, and deny on Salaries. Analysts then read everywhere, write Budget, and are blocked from Salaries; an unrelated user still sees nothing (closed default); an admin sees everything.

Surface

• REST: GET/PUT /api/v1/acl/cube-grants (admin), with a single-knob level of none | read | write | admin | deny, applied atomically. OpenAPI updated.
• Web: a Cube grants tab in the security console listing the full cube-access picture and setting grants at the global or per-cube scope.
• Model-as-code: a new additive [[cube_grant]] block in the security artifact; pre-m8.2 files load and re-serialize unchanged.

Quality

• New unit resolution matrix, end-to-end REST acceptance suite, and serialization round-trip tests; full workspace green, clippy and fmt clean.
• Hardened after an adversarial review: atomic single-knob writes (no half-applied state on I/O failure) and fail-closed, idempotent loading of hand-edited grant rows.

Compatibility: fully backward compatible. With no global grants or denies defined, behavior is identical to m8.1.