refactor: simplify auth and subscription links

internal/database/repo_test.go

@@ -178,7 +178,7 @@ func TestSettingsCRUD(t *testing.T) {
 
 	// Update
 	updated, err := repo.Update(map[string]any{
-		"theme": map[string]any{"name": "dark"},
+		"theme":   map[string]any{"name": "dark"},
 		"appName": "MyStore",
 	})
 	if err != nil {
@@ -198,48 +198,6 @@ func TestSettingsCRUD(t *testing.T) {
 	}
 }
 
-func TestGrantCRUD(t *testing.T) {
-	db := testDB(t)
-	defer db.Close()
-	repo := NewGrantRepo(db)
-
-	// Create
-	grant, token, err := repo.Create("source", "test-src", "mihomo", nil)
-	if err != nil {
-		t.Fatalf("create failed: %v", err)
-	}
-	if token == "" {
-		t.Error("expected non-empty token")
-	}
-	if grant.ID == "" {
-		t.Error("expected non-empty grant id")
-	}
-
-	// List
-	list, err := repo.List()
-	if err != nil {
-		t.Fatalf("list failed: %v", err)
-	}
-	if len(list) != 1 {
-		t.Errorf("expected 1 grant, got %d", len(list))
-	}
-
-	// Authorize with correct token
-	if !repo.AuthorizeScoped(token, "source", "test-src", "mihomo") {
-		t.Error("expected authorization to succeed")
-	}
-
-	// Authorize with wrong resource
-	if repo.AuthorizeScoped(token, "collection", "test-src", "mihomo") {
-		t.Error("expected authorization to fail for wrong resource type")
-	}
-
-	// Authorize with wrong target
-	if repo.AuthorizeScoped(token, "source", "test-src", "surge") {
-		t.Error("expected authorization to fail for wrong target")
-	}
-}
-
 func TestCacheCRUD(t *testing.T) {
 	db := testDB(t)
 	defer db.Close()