Extend Contract Grace

Account Management lengthens a contract's post-term access window.

Gated on the Accounts permission rather than the generic approvals one: extending paid access is a commercial decision, like the cancellation approve/decline pair.

Nested under /requests/{request_id}/ deliberately — that path shape is what makes AdminAuditLoggingMiddleware record the actor, body and timestamp, so who/when/why come for free and the extension appears in the request's existing timeline with no new table.

Extensions are monotonic: 422 if the proposal doesn't move the date later. 409 if the contract is no longer live — revoked access has to be re-provisioned, not restored by editing a date.