app.tempomusic.staff.grantStaffRole

Add a DID to the moderators allowlist with the given role. Requires the caller to have the `superAdmin` role. Writes a `moderatorGranted` audit row only when a new row is inserted or a revoked row is reactivated. Idempotent: granting a DID that already holds the same active role returns 200 with `granted: false` and no audit row.