Implement Phase 12: Policy Engine

[richardkiene]

Summary

• Add policy evaluation engine for deny/require/warn rules from mortar files
• Integrate policy check into connection validation pipeline with audit logging
• Add API endpoints for policy inspection

Changes

• Policy Types: PolicyDecision enum (Allow/Deny/Warn), PolicyEvaluationContext, EvaluatedPolicy, PolicyInfo
• Policy Engine: Core evaluation logic for deny rules (with exceptions), require rules, and warn rules (cross-network detection)
• Policy Manager: Lifecycle management per mortar project with service-to-mortar mapping
• Events: PolicyEvaluated and PolicyViolation event types for audit logging
• API: GET /v1/policies and GET /v1/policies/{mortar_id} endpoints
• Integration: Policy check added to validate_connection() in network validation

Test plan

• 8 unit tests for PolicyEngine rule matching
• 6 unit tests for PolicyManager lifecycle
• 6 unit tests for PolicyDecision and types
• 11 E2E tests covering:
  • Policy load/unload lifecycle
  • Deny rules blocking connections
  • Deny rules with exceptions
  • Warn rules for cross-network communication
  • Multiple deny rules (first match wins)
  • Wildcard deny rules
  • Mortar project isolation
  • Policy events emitted
  • Serialization