Proposal: prove-single-use-grant-consumption

The PDPP grant model exposes a single_use access mode that is central to the protocol's safety story — it bounds the blast radius of a grant to one retrieval session and prevents silent reuse. The reference implementation has enforced this atomically since the initial grant implementation, but the enforcement had no HTTP-boundary proof:

The reference implementation's single_use access mode SHALL have an integration-test proof that operates at the HTTP boundary — not only a test of token reuse with the already-issued token, but a proof that a second token issuance against a consumed grant is rejected with a typed error code.