Wire auth explain to local auth ops

AGENTS.md

@@ -111,7 +111,9 @@ Roadmap items should be actionable and checkable:
   payloads. The keychain reducer builds an active identity view for admin keys,
   users, devices, nodes, agents, and endpoint bindings.
 - The auth reducer builds a current permission view for resources, grants,
-  groups, and bearer access. Daemon-side enforcement is still roadmap work.
+  groups, and bearer access. The daemon persists local auth grant/revoke ops
+  and uses them for `auth explain`. Signature validation and daemon-side module
+  enforcement are still roadmap work.
 - Signed peer-card LAN discovery payloads, peer auth over Iroh, cr-sqlite,
   iroh-docs, iroh-gossip, iroh-blobs, Automerge sync, real auth enforcement,
   OpenSSH KRL generation, and Keyhive/BeeKEM-style authorization are future