Issue #3593532: kindAccess honors per-item write grants on unique kinds

Frank Mablyrequested to merge
issue/pdv-3593532:3593532-kindaccess-ignores-per-item into 1.x

The webform save-to-vault gate uses kindAccess(write) to decide writability, but kindAccess resolved kind-level trust only and ignored per-item grants -- so a user with a write grant on their existing record was blocked even though updateRecord would have allowed the write.

kindAccess now composes trust and grant via the existing scope primitives (trustedKindsByScope + listItemsByScope), gated to unique kinds where the single item is an unambiguous target (matching updateRecord). Adds Vault::isUniqueKind() as the single uniqueness predicate, reused by lockUniqueKind. Tests cover grant-only writability, the non-unique exclusion, and the no-auth denial.

Closes #3593532

Merge request reports