Repair an employee's grants and cached service access

Edit identity-plan.json. grants needs unique id, kind (role or permission), target, window ([from,to]) and approval ID. A grant must fit its exact immutable approval, and every active permission including inherited/direct access must fit the current employment phase. Retire old memberships and direct grants at the move; remove all grants at departure. serviceModes needs one {id,mode} for ledger and reports, with mode snapshot or online. Snapshot services use each valid token's immutable issued claims plus its revocation time, and do not independently read employment/directory state. Online services use a valid token but check current employment and current directory permissions on every request; the modeled online service is available, authoritative and uncached. Directory changes alone do not change snapshot claims. Permissions visible at a service are intersected with that service's supported permissions and unioned across every usable token. tokenActions is a nondecreasing slot ledger with distinct id, op, slot, actor and token. issue also needs expires. Issuance requires an employed subject, unused token ID, authorized actor and at most 8 slots of validity; it snapshots all directory permissions active at that issue slot. revoke requires an existing issued token that has not already been revoked, and an authorized actor. Failed operations have no token effect; grants themselves remain modeled even when authority/lifecycle checks fail separately. Future tokens cannot be used before issuance. Provide all required operations throughout each phase while preventing other permissions, incompatible duties and any service access from slot 11. Choose online current authorization or explicit snapshot token replacement/revocation; do not manufacture a new approval or merely rename a privileged role.