Historia clinica ships behind a gate no identity can pass: zero admin:enamel grants exist fleet-wide

Own measurement from ENAMEL-24: zero admin:enamel grants exist fleet-wide, so the shipped surface renders empty for every live identity. GO from pmmaster (2026-09-11 22:51 ART, relayed Elazar authority) - establish WHERE the first admin:enamel grant would be created, WITHOUT issuing one to self or a test identity (that would manufacture the reachability the acceptance is supposed to prove - a security regression). App-side group/role value question (users/appKeys/grantGroup path) is mine to investigate; if it terminates in DDL or a database grant, it stops there and routes to db-enamel-cc, reported not executed.