#3547 access grant list --server shows user subjects as user:user:<name>

Summary

Against a swamp serve --auth-mode token server, swamp access grant list --server <url> prints user subjects with the kind doubled, for example user:user:member for a grant whose subject is user:member. Listing the same grants locally (without --server) prints user:member.

Found while verifying swamp-club#3085 against a compiled binary driving a real serve.

Likely path

• handleAccessGrantList (src/serve/handlers/access_handlers.ts) builds subjectDisplayNames for user subjects, falling back to the principalEmail of the subject's server tokens (serverTokenList).
• formatSubject (src/presentation/renderers/access_grant.ts) renders a resolved user subject as the kind, a colon, then the display name.
• If the display name supplied for the subject is itself already prefixed (for example a token whose principalEmail holds the principal id user:member rather than an email), the kind is printed twice.

Not yet confirmed which value carries the prefix; triage should reproduce it and check what principalEmail holds for tokens minted for a user without an email.

Expected

The subject is printed once, user:member (or user:<display name> when one resolves), in both log and JSON output, matching the local listing.