4.7 Add initial auto-accept grant models

[marwannettour]

Parent epic: #310

Summary

Introduce models for future trusted-client auto-accept authorization.

Requirements

• Add TrustedClientSessionGrant with trusted client ID, trusted public key hash, scope, optional profile ID, auto-accept mode, creation date, optional expiration date, and revocation flag.
• Add TrustedSessionGrantScope values Global, Profile, and OneShotSession.
• Add AutoAcceptMode values Disabled, AskConfirmation, AutoJoin, AutoInventory, and AutoSynchronize.

Acceptance criteria

• Grant models can represent global, profile, and one-shot permissions.
• Grant models are not required to fully automate acceptance yet.