@spec duplicate_grant(
  [Lockspire.Domain.ConsentGrant.t()],
  Lockspire.Domain.ConsentGrant.t()
) ::
  {:reuse, Lockspire.Domain.ConsentGrant.t()} | :none

Finds an existing active grant that a new approval would merely duplicate.

Distinct from reusable_grant/3, which decides whether consent can be skipped. This runs after the subject has approved — prompt=consent deliberately re-shows the consent screen, so an approval for a client the account already remembers is an ordinary occurrence, not a skipped one.

Only exact duplicates match: same account and client, already-granted scopes covering the requested set, and identical authorization details. A broader scope set or different RAR details is a genuinely new grant.