Function valid_selector 

pub fn valid_selector(selector: &str) -> bool

A principal selector on either axis of an AudienceGrants entry: * (any authenticated principal), user:<email> (matches AuthContext.email), or group:<g> (matches any entry in AuthContext.memberships – the caller’s resolved, transitive local-group closure). Validated at parse time; resolve/resolve_audience never see an unrecognized shape.

pub – analytics-web-srv’s admin grant-write route (a separate crate) needs to run this exact same selector-shape check parse/from_rows run, not a re-implementation of it.