Get where an identity holds each permission

Returns, for the current Environment, one page of (permission, node_id) rows: every permission the identity holds, paired with each hierarchy node its grants were made at — the nodes themselves, not expanded through their descendants. Rows are ordered by permission, then node; a caller building the whole map walks every page. A grant already means "this node and everything beneath it", so a caller answers a node-scoped question by walking up from the node in question and looking for one of these roots, using a copy of the parent edges fetched once from GET /api/v1/nodes/parents and shared across identities. Answers both scopes without a further call: the permission appearing at all is the Application-wide answer, and the walk is the node-scoped one. By default, assignments outside their effective window are excluded. With include=windows, every assignment is a row carrying effective_from and effective_to (null for an unbounded side), in effect or not, so a caller applies the window itself: it can say why a check fails (the grant has ended, or has not begun) and drop a grant at its boundary without reading again. Returns 404 when the identity has no membership in this Environment.