Function Can

Can(
    action: "create" | "read" | "update" | "delete" | "cancel",
    subject:
        | "Organization"
        | "Member"
        | "Invitation"
        | "Workspace"
        | "Role"
        | "RoleGrant",
): CustomDecorator<string>
声明端点所需的租户级授权（module-rbac-casl 乙裁·CASL 惯用形）。
Parameters
- action: "create" | "read" | "update" | "delete" | "cancel"
  动作（AuthorizationAction 词汇）
- subject: "Organization" | "Member" | "Invitation" | "Workspace" | "Role" | "RoleGrant"
  资源（AuthorizationSubject 词汇·PascalCase）
Returns CustomDecorator<string>
挂 CAN_KEY 元数据的 Nest 路由装饰器
Remarks
由 AuthorizationGuard 回读，携 ALS 预注入的角色交 PERMISSION_CHECKER 端口裁决（CASL·授权事实 SSOT = DB grant 行·module-rbac-dynamic-roles 丙裁）——声明是请求，裁决在引擎，无散点特判。

subject 词表 = AuthorizationSubject 词汇表（PascalCase·语言 SSOT）；新增资源先入词汇表，类型即随之可声明（编译期防旁逸）。
Example
```
`@Can('read', 'Workspace')`
@public
```
- Defined in libs/core/src/authorization/can.decorator.ts:39