Sync Grants

Mirror workspace membership into the graph backend (idempotent).

Resource ownership is granted at create time by grant_resource_owner and was backfilled onto the resource model, so this endpoint only ensures the workspace-member tuples that gate group defaults are present.