Enforce a scoped action grant

Implement authorize(request, grant, now) -> bool. Request must have exactly tenant, audience, action, resource, destination, units. Grant must have exactly tenant, audience, actions, resources, destinations, max_units, expires. Identity and names are nonempty strings; units and max_units are nonnegative integers excluding booleans; now/expires are integers. Grant scopes are lists of nonempty strings. Allow only matching tenant/audience, allowed action/resource/destination, units <= max_units, and now < expires. Return False on malformed data. This assumes the grant and identity context are already authenticated by a trusted caller; it is not token validation.