[samgbafa]

Adds direction: "issued" to POST /delegation/query: lists the delegations the calling key issued.

• Authorization: a separate check from the did:pkh account path (unchanged). Exactly one tinycloud.delegation/list capability on <invoker DID>/delegation (empty path/query/fragment), no proof; verify_and_authorize still runs. Rows are filtered by delegator == invoker only; the account-wide loader is not called.
• Query: seek on idx_delegation_delegator (delegator, id), ordered by id (not chronological; issuedAt is in each item), reads at most limit+1 rows. Abilities and ancestor state are loaded for the page's rows only.
• Cursor: last scanned row id bound to invoker, status and space. A cursor from another invoker/filter, a legacy CID cursor or garbage gets the same 400. A cursor id is only a key position among the invoker's own rows and is never looked up. Filtered pages can be short; only a missing nextCursor ends the listing.
• Items are the existing schemaVersion 2 shape, direction: "granted". /info features gain delegation-issued-query-v1.
• granted/received/all: record building moved into a shared helper; response bytes pinned by a new test.

Tests: db::test::issued_* (paging, filtered scan over 1000 rows, statement recording + EXPLAIN on a DB with many other issuers, cursor binding) and routes::tests::delegation_issued_query (own-DID only, proof/other-DID refusals, HTTP paging and cursor errors, existing-direction bytes, /info). No existing test or assertion changed.

Details: TC-2132

[samgbafa]

APPROVE: see TC-2132 (reviewed exact head 6245fee)
Adds direction "issued" to POST /delegation/query on its own authorization path (exactly one tinycloud.delegation/list on the invoker own DID, no proof; filter delegator == invoker; index seek with limit+1 reads; abilities and ancestor state for the page only; cursor bound to invoker, status and space with one uniform 400) and the delegation-issued-query-v1 /info feature. The shared record builder is a line-for-line extraction of the removed inline code (the old continue statements are now an early return of None); granted/received/all are unchanged. Findings of the independent review (deep-chain cap, extra capabilities, did:pkh principal, releasing checklist) are addressed with new tests only; no existing assertion is edited. Branch is 2 commits behind main (#466, #462): merge up before merging (CHANGELOG only expected); a merge-up-only head needs no re-review if the non-CHANGELOG patch-id is unchanged. CI pending. Ships in 1.25.9 with #443.

[samgbafa]

APPROVE: see TC-2132 (reviewed exact head 6d62cdf)
Merge-up of main (1212904, #443) into the branch approved at 6245fee: the non-CHANGELOG patch-id is unchanged (899d90f22273ce17 at both heads; git diff -- :!CHANGELOG.md | git patch-id --stable); the only CHANGELOG change against main is the direction "issued" line. 0 behind main. The earlier reviews apply: the independent GPT review (REQUEST CHANGES, all findings addressed with new tests) and my review at 6245fee. Ships in 1.25.9 with #443; /info reports delegation-issued-query-v1.