taOS #2148 follow-ups: populate expires_at (time-box grants) + Agents-app revoke surface

[hognek]

Follow-ups split out of #2148, whose main fix (a real revoke + an honest assign-agent) lands in a PR. Two acceptance items from that issue are deliberately NOT in it.

1. Time-boxed grants: nothing ever populates expires_at

expires_at exists in the agent_grants schema and is already honoured at check time — _grant_unexpired in tinyagentos/agent_token_auth.py is applied by check_agent_scope, check_agent_scope_for_project and check_agent_project_grants, and GET /api/agents/registry/grants filters on it — but no path ever SETS it, so a grant can only be revoked, never expired.

The scope request carries duration_secs (see agent_scope_requests_store.add_grant's callers and the request create route), so the approve path could populate expires_at = now + duration_secs when the requester asked for a bounded grant.

Not folded into the revoke PR because #2148's acceptance explicitly says "Existing grant/approve flows unchanged", and populating the column changes what an approval grants. It should be its own change with its own tests (a request with duration_secs produces an expiring grant; an expired grant is refused by every check path; an unbounded request still grants without expiry).

2. Agents-app revoke surface (and the assign dialog's authoritative scope list)

An operator should not need the API to undo a grant they made in the UI.

• Show an agent's active grants (per project) with a Revoke action backed by the new POST /api/projects/{id}/members/revoke-agent.
• desktop/src/apps/agents/AssignAgentToProjectDialog.tsx sends only its three scope presets (project_tasks, canvas_read, canvas_write). Since assign-agent's scopes list is now the agent's COMPLETE scope set for the project (that is the honest-reporting fix in SECURITY: agent scope grants can be granted but never revoked (and assign-agent falsely reports revocation) #2148), re-assigning a project through that dialog revokes any scope the agent holds outside those presets — e.g. files_read or project_notes granted through a consent or scope request. The dialog must load the agent's current project scopes and show them, so the operator removes a scope on purpose rather than as a side effect of clicking "Assign".

Done in the #2148 PR (for the record): AgentGrantsStore.revoke_grant / revoke_all_for_project, the owner-or-admin revoke-agent route with project-activity audit logging, assign-agent reconciling the project grant set and failing loudly (500) if the reconciliation does not land, and the doc/changelog updates.