feat(cases): enforce purpose-bound case governance

src/govoplan_cases/backend/dsar_provider.py

@@ -288,6 +288,7 @@ def _matching_grants(
     for kind, value in (
         ("account", selectors.account_id),
         ("identity", selectors.identity_id),
+        ("membership", selectors.membership_id),
     ):
         if value:
             conditions.append(
@@ -431,6 +432,10 @@ def _grant_subject_matches(
     return bool(
         (row.subject_kind == "account" and row.subject_id == selectors.account_id)
         or (row.subject_kind == "identity" and row.subject_id == selectors.identity_id)
+        or (
+            row.subject_kind == "membership"
+            and row.subject_id == selectors.membership_id
+        )
     )
 
 
@@ -531,6 +536,9 @@ def _access_grant_record(row: CaseAccessGrant) -> DsarRecordRef:
             "subject_kind": row.subject_kind,
             "subject_id": row.subject_id,
             "permissions": [str(value)[:40] for value in row.permissions[:20]],
+            "allowed_purposes": [
+                str(value)[:255] for value in row.allowed_purposes[:100]
+            ],
             "source": _bounded_text(row.source, 30),
             "active": row.active,
             "source_revision": row.source_revision,
@@ -562,6 +570,7 @@ def _timeline_record(
             "match_fields": list(match_fields),
             "case_id": row.case_id,
             "event_type": _bounded_text(row.event_type, 120),
+            "purpose": _bounded_text(row.purpose, 255),
             "case_revision": row.case_revision,
             "occurred_at": _iso(row.occurred_at),
             "actor_id": row.actor_id if expose_actor else None,