Component: Delegation-Chain Query API
What it is: a first-class read API — given a logged action, returns the full delegation chain back to the consenting human.
What it does: one primary-key read plus a join to the originating consent — never a recursive walk — because the chain was already assembled hop by hop at write time.
Why O(1) instead of a walk: each hop's token already carries the signed action_id of the
allow that minted it, so the Audit Log writes parent.chain + [this hop] at
write time. Completeness was decided then too — a chain that can't be fully linked reports
exactly where and why (PARENT_NOT_FOUND, PARENT_MISMATCH, PARENT_INCOMPLETE,
LEGACY_TOKEN, LEGACY_RECORD), never a silent partial result.