feat: select users in file access explanations

src/govoplan_files/backend/manifest.py

@@ -978,7 +978,7 @@ manifest = ModuleManifest(
             summary="List, grant, update, expire, or revoke direct read, write, and manage access without changing ownership.",
             body=(
                 "File owners and file administrators can manage direct shares for users, groups, the tenant, and Campaign. Expired and revoked grants stop authorizing access immediately while independent active grants remain effective. "
-                "The Files share dialog lists active and historical grants, and revocation is idempotent."
+                "The Files share dialog lists active and historical grants, and revocation is idempotent. The access explanation action evaluates the signed-in user by default. When Policy permits selected-user diagnostics, the same shared dialog can evaluate another active user in the current tenant; those cross-user diagnostics are recorded in audit evidence and do not grant access."
             ),
             layer="available",
             documentation_types=("user",),
@@ -1003,7 +1003,7 @@ manifest = ModuleManifest(
                     kind="repository",
                 ),
             ),
-            related_modules=("campaigns",),
+            related_modules=("access", "audit", "campaigns", "policy"),
             unlocks=(
                 "A supporting process can grant governed file access without changing file ownership.",
             ),
@@ -1025,6 +1025,7 @@ manifest = ModuleManifest(
                 "limitations": [
                     "Campaign-target grants are normally created by the Campaign integration rather than selected manually in the Files dialog.",
                     "A user may retain access through another active direct grant or ownership path after one share is revoked.",
+                    "Selected-user explanations require Policy permission and are diagnostics only; they do not impersonate the user or grant file access.",
                 ],
                 "outcome": "Direct access has the requested permission and lifetime while the managed asset keeps its owner.",
                 "verification": "Test one intended and one denied path, then expire or revoke the grant and verify that only independent access paths remain.",