CogmapGrantBody

HTTP body for POST /api/cognitive-maps/{id}/grants — the subject is the path {id} (a cogmap),
so the body carries only the principal + capabilities. The handler widens this into a
GrantCapabilityRequest with subject_table='kb_cogmaps', subject_id={id}.

{
    "can_delete": true,
    "can_grant": true,
    "can_read": true,
    "can_write": true,
    "principal_id": "b0fe3bdd-8201-445a-aab3-a018692d6aca",
    "principal_table": "string"
}