Refactor read filter from per-item grant to per-document ReadCap

Model the read filter on NextGraph's real ReadCap mechanism instead of an
invented per-item grant. Verified in nextgraph-rs: there is no Document type
(document = repo); a store is a container repo referencing other repos by RDF
overlay; holding a store's cap does NOT grant the repos it contains (each repo
needs its own cap; no read-cap inheritance). So the access unit is the
DOCUMENT = an item's `@graph`, never the item.

- caps.ts: CapRegistry (read/write caps per document NURI + public docs;
  open/grantRead/grantWrite/makePublic/canRead/canWrite/governsRead/
  hasReadPolicy). Replaces access.ts (Grant).
- read-filter.ts: filter keeps an item iff its `@graph` document is readable
  (held cap or public); items with no `@graph` or in an ungoverned document are
  kept. No injected grantOf — the filter reads `@graph` and consults the
  registry (automatic, domain-agnostic).
- polyfill.ts: getCaps()/resetCaps() replace setGrantOf/getGrantOf; useShape
  filters only when caps.hasReadPolicy() (else passthrough, no regression).
- tests: caps.test.ts (6) + read-filter.test.ts (4), incl. no-inheritance
  between documents. 10 pass; tsc rc=0.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packages/client/src/polyfill.ts

@@ -9,7 +9,7 @@
  */
 
 import type { NgLike, UseShapeLike, PrincipalId } from "./types";
-import type { GrantResolver } from "./read-filter";
+import { CapRegistry } from "./caps";
 
 export interface EventuallyConfig {
   /** The REAL `@ng-org/web` `ng` (injected to avoid a hard import / alias loop). */
@@ -24,18 +24,17 @@ export interface EventuallyConfig {
   init?: (...args: any[]) => any;
   /** REAL `@ng-org/orm` `initNg` (ORM signals) — forwarded by the lib's `initNg()`. */
   initNg?: (...args: any[]) => any;
-  /** How to read a document's emulated grant. When set, reads are filtered. */
-  grantOf?: GrantResolver;
 }
 
 let cfg: EventuallyConfig | null = null;
 let currentUser: PrincipalId | null = null;
-let grantOf: GrantResolver | null = null;
+/** The emulated ReadCap/WriteCap registry. Empty until the app declares caps;
+ *  while it has no read policy the read filter passes through (no regression). */
+let caps = new CapRegistry();
 
 export function configure(c: EventuallyConfig): void {
   cfg = c;
   currentUser = c.currentUser ?? null;
-  grantOf = c.grantOf ?? null;
 }
 
 /** @internal — used by the SDK-shaped wrappers to reach the injected real SDK. */
@@ -53,16 +52,17 @@ export function getCurrentUser(): PrincipalId | null {
   return currentUser;
 }
 
-/** Set/clear how reads resolve a document's grant. null → reads pass through. */
-export function setGrantOf(fn: GrantResolver | null): void {
-  grantOf = fn;
+/** The emulated cap registry — the app grants/opens caps on it (as it will via
+ *  real cap operations in the target). The read filter consults it. */
+export function getCaps(): CapRegistry {
+  return caps;
 }
 
-export function getGrantOf(): GrantResolver | null {
-  return grantOf;
+/** Reset all emulated caps (mainly for tests / fresh sessions). */
+export function resetCaps(): void {
+  caps = new CapRegistry();
 }
 
-// Capability helpers — polyfill-era surface (caps are emulated now; native at
-// migration). Re-exported here so the whole polyfill API lives under /polyfill.
-export { canRead, canWrite, defaultGrant, grantRead } from "./access";
-export type { GrantResolver } from "./read-filter";
+// Cap surface — polyfill-era (caps are emulated now; native at migration).
+// Re-exported here so the whole polyfill API lives under /polyfill.
+export { CapRegistry } from "./caps";