📄️The organizations the caller holds a grant at
Answers the caller's own active grants: for each, the organization id (the value to send as `Oktoid-Acting-For` on every other call), its path and the bundle code. It acts for no organization, so it takes no `Oktoid-Acting-For` (a header sent is ignored) and needs no permission. A caller with no grant, a token that maps to no principal and a suspended principal all get 200 with an empty list. Read fresh on every call, not through the principal cache, so a grant made or revoked shows at once.