feat: enforce DDS token access through common grants

dds-backoffice/src/main/java/com/cloudhandson/ddsbackoffice/service/DdsGrantPublisher.java

@@ -18,11 +18,16 @@ import org.springframework.stereotype.Service;
 /**
  * Compiles the application's effective permission model into DDS grants.
  *
- * DDS does not evaluate CB_PERMISSION at query time. This service is the
- * explicit publish boundary: application users/groups/roles are expanded,
- * ALLOW/DENY rules are compiled into one predicate per user/object, and the
- * resulting DATA GRANT is created or replaced. A publish with no ALLOW rule
- * drops the reserved grant, preserving default deny.
+ * This service is the explicit publish boundary for the direct END USER
+ * comparison path: application users/groups/roles are expanded, ALLOW/DENY
+ * rules are compiled into one predicate per user/object, and the resulting
+ * DATA GRANT is created or replaced. A publish with no ALLOW rule drops the
+ * reserved grant, preserving default deny.
+ *
+ * The token-driven vector path is intentionally separate. Its object-level
+ * DATA GRANT calls a definer-rights predicate function that evaluates the
+ * common CB_* tables at query time after CB_AGENT_CTX has been initialized by
+ * the bearer token.
  */
 @Service
 public class DdsGrantPublisher {