feat: add access_grants table [D109] dynamic permission interface (冰朔手动生成)

persona-brain-db/schema/15-access-grants.sql

@@ -0,0 +1,26 @@
+-- ============================================================
+-- 表15：access_grants（访问权限表）
+-- 用途：动态权限接口，由冰朔手动生成
+-- 冰朔权限控制三层：对国家系统逻辑完全透明 → 国家系统逻辑审核 → 光湖团队审核 → 冰朔本人
+-- ============================================================
+
+CREATE TABLE IF NOT EXISTS access_grants (
+  grant_id          VARCHAR(64)   PRIMARY KEY,
+  grantee_type      VARCHAR(16)   NOT NULL
+                    CHECK (grantee_type IN ('persona', 'system', 'national', 'user', 'emergency')),
+  grantee_id        VARCHAR(64)   NOT NULL,
+  resource_type     VARCHAR(32)   NOT NULL,
+  resource_id       VARCHAR(64),
+  permissions       TEXT          NOT NULL,        -- JSON array of permissions
+  grant_conditions  TEXT,                          -- JSON object of conditions
+  valid_from        TIMESTAMP     NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  valid_until       TIMESTAMP,
+  issued_by         VARCHAR(64)   NOT NULL,
+  status            VARCHAR(16)   NOT NULL DEFAULT 'active'
+                    CHECK (status IN ('active', 'revoked', 'expired')),
+  created_at        TIMESTAMP     NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+
+CREATE INDEX IF NOT EXISTS idx_ag_grantee ON access_grants(grantee_type, grantee_id);
+CREATE INDEX IF NOT EXISTS idx_ag_resource ON access_grants(resource_type, resource_id);
+CREATE INDEX IF NOT EXISTS idx_ag_status ON access_grants(status);