feat(grant): one row per grantee, and project grantees in the repo picker

repo/project grant list listed a grantee once per way it holds the target: a direct repo grant and the project's access were two rows for the same account. The table now folds them into one, with the strongest role and each source labelled with its role ("direct (admin), project:web (reader)"), so revoking the direct grant visibly leaves the inherited one. --json keeps the wire rows as sent.

The interactive repo grant add offered org members only, so an account the project grants without being an org member was never offered on the repo. The repo pool now also takes the project's direct account grantees the org listing did not cover, minus direct repo holders.

Rows keep coming from the grant listings, not /people: those listings carry team, org and service-account grants and fail rather than hiding directGrant when authz is degraded. Names on project/repo rows wait on core adding displayName to ProjectGrant/RepoGrant.