feat(dbt_project): support DBT PROJECT grants

[usbrandon]

What

Adds DBT PROJECT (dbt Projects on Snowflake) as a schema-scoped grantable resource type:

grants:
  - priv: USAGE
    on: dbt project <db>.<schema>.<proj>
    to: <runner_role>
  - priv: MONITOR
    on: dbt project <db>.<schema>.<proj>
    to: <observer_role>

USAGE executes the project (EXECUTE DBT PROJECT) and lists/retrieves its files; MONITOR exposes project details + run history in Snowsight. Schema-scope CREATE DBT PROJECT supports deploy-from-Workspace.

Change (mirrors the CORTEX SEARCH SERVICE grant support)

• enums.py: ResourceType.DBT_PROJECT.
• privs.py: DbtProjectPriv (ALL/MONITOR/OWNERSHIP/USAGE), PRIVS_FOR_RESOURCE_TYPE entry, SchemaPriv.CREATE_DBT_PROJECT.
• resources/resource.py: RESOURCE_SCOPES SchemaScope() (grants only; no concrete resource class yet).
• data_provider.py: fetch_dbt_project() — needed to resolve on: dbt project grant references at plan time (SHOW DBT PROJECTS).
• Tests: TestDbtProjectPriv + test_grant_on_dbt_project.
• Docs: docs/resources/dbt_project.md, grant.md example, mkdocs.yml nav.

Validation

Verified end-to-end against a live account: created a dbt project object, and GRANT USAGE/MONITOR ON DBT PROJECT ... TO ROLE plans + applies cleanly. Full dbt project resource modeling (CREATE DBT PROJECT ... FROM) is left for a future PR — this covers grants.

🤖 Generated with Claude Code

[noel]

Thanks @usbrandon — this is a clean mirror of the CORTEX SEARCH SERVICE grant support and it slots into every touch point correctly. I checked out the branch and verified locally:

• resource_label_for_type(DBT_PROJECT) → dbt_project, which matches the fetch_dbt_project dispatch, so on: dbt project references resolve at plan time.
• on_dbt_project= is auto-derived — no extra registration needed.
• New tests + full test_grant.py / test_privs.py: 152 passed, no regressions.

Because there's no concrete resource class, there's no drift surface here — nice and low-risk.

Requested changes (both minor)

1. Safer comment access. fetch_dbt_project uses data["comment"] (bracket). If SHOW DBT PROJECTS ever omits that column it'll KeyError. Please switch to data.get("comment").
2. Fix the placeholder doc link. docs/resources/dbt_project.md:68 has (see [Schema](#) grants) — the # links nowhere. Point it at schema.md (or drop the link).

Looks good

• Enum / DbtProjectPriv / PRIVS_FOR_RESOURCE_TYPE / SchemaPriv.CREATE_DBT_PROJECT / RESOURCE_SCOPES are all present and correct.
• Tests cover both USAGE and MONITOR rendering plus on_type.
• Docs are accurate — the managed-access-schema / MANAGE GRANTS note is a good addition.

No concern about the absence of a direct fetch_dbt_project unit test — that's consistent with the rest of the fetch layer. Thanks again!

[usbrandon]

Both items addressed in 749aef6:

1. fetch_dbt_project now uses data.get("comment") instead of bracket access.
2. The placeholder link in docs/resources/dbt_project.md now points at schema.md.

test_grant.py / test_privs.py: 152 passed.