[BUG] batch_grant_access does not actually create AccessGrant accounts on-chain

[StaySafe020]

The batch_grant_access instruction validates inputs and emits a BatchAccessGrantedEvent but does not actually create any AccessGrant PDA accounts. The code contains an explicit comment acknowledging this:

// Note: Actual account initialization must be done via CPI or
// multiple transactions. This is a simplified version that
// validates inputs and emits an event for off-chain processing.

Any frontend or client that calls batch_grant expecting grants to be stored on-chain will get no effect — the providers receive no actual access.

Steps to Reproduce

1. Call batch_grant_access with valid providers and roles
2. Attempt to use one of the providers to access a record
3. Access is denied — no AccessGrant account was ever created

Expected Behavior

Each provider in the batch should have an AccessGrant PDA created on-chain with the specified permissions.

Actual Behavior

Only an event is emitted. No on-chain state is written.

Environment

• Anchor: 0.32.1
• Network: localnet / devnet

Component Affected

• Smart contract (programs/cyphermed)
• Backend API (backend/)
• Frontend (app/)
• Tests
• Documentation