Function hasScope

Pure grants-map lookup. No implicit owner/admin bypass -- mirrors GatewayClaimsManager.hasScope exactly: "admin status alone does not imply the capability, only an explicit grant does."