DataStoreAppGrantStore
An AppGrantStore that keeps every grant as one JSON list under one key of a Preferences DataStore the host supplies.
The list is small (one row per app and account) and read on every guarded call, so one key read whole is cheaper than a table. A value that no longer parses reads as no grants and is reported once, so a damaged store fails closed rather than crashing the host.