Create S3 Grant

Award S3 tokens to a client, writing the grant and its full vesting schedule.

Credits nothing here — the vesting executor posts each period's credit when its vest_at arrives, including an immediate grant's single already-due period. That keeps every S3 credit on one code path with one idempotency anchor.

Returns the grant_id so the UI can link to the award it just created, and replays safely: the same idempotency key returns the stored grant with already_existed=true and writes nothing.

Naming a block_request_id whose contract does not exist yet holds the award awaiting_contract with no vesting rows: there is no billing anchor until the contract starts, and the subscription webhook builds the schedule then. Such a response carries effective_at: null and vesting_count: 0.