Lists the locations where the calling user holds a given authority (a permission or role slug, e.g. p/r-product or r/manage-locations). Useful for building location pickers scoped to what the caller may actually do.