feat(policies): PolicyDescriptor + nested test body + XACML PERMIT

[jlc488]

Third PR in the admin-ui ↔ backend contract-gap series (after #14 menus, #15 audit-logs). The Policies page needs name+description rows for the list and a nested (subject, action, resource, environment) body for the dry-run tester; this controller returned bare strings and accepted a flat request with name in the path.

Summary

SPI changes

• PolicyDecision: ALLOW → PERMIT. Adopt the XACML 3.0 vocabulary (PERMIT / DENY / NOT_APPLICABLE) so the admin UI's Tag rendering and downstream auditors see the standard names.
• Policy interface: new default String description() { return null; } hook. Backward-compatible — existing policies don't need to change unless they want to surface human-readable text in the UI.
• DefaultPolicyEvaluator: new registeredPolicies() returning the Policy objects (not just names) so the admin controller can read descriptions without changing the PolicyEvaluator contract.

Test

• DefaultPolicyEvaluatorTest — renamed returnsAllowFromMatchingPolicy → returnsPermitFromMatchingPolicy and updated all PolicyDecision references.

Controller rewrite

• GET /admin/api/v1/policies → [{name, description}] sorted by name. Matches the admin UI's PolicyDescriptor interface.
• POST /admin/api/v1/policies/test (no name in the path) takes the admin UI's nested body:

  {
    "policyName": "...",
    "subject":  { "userId": "...", "tenantId": "...", "attributes": { ... } },
    "action":   "...",
    "resource": { "type": "...", "id": "...", "attributes": { ... } },
    "environment": { ... }
  }

• Response: {effect, reason, matchedRules} matching the UI's PolicyTestResponse.

Honest caveats (queued follow-ups, not in this PR)

1. Subject attributes and action aren't consumed by the current PolicyContext — it has resourceAttributes and environmentAttributes but no subject-attribute slot. Subject attributes flow through environment for now; promoting them to first-class lives in a follow-up.
2. reason and matchedRules are placeholders today because Policy.evaluate still returns only a PolicyDecision enum with no detail. Promoting the SPI to return a richer decision (PolicyEvaluation { decision, reason, matchedRules }) is queued as a follow-up so this PR stays focused on the wire contract.

Test plan

• ./gradlew build green (55 tasks, all tests pass — only the access-core test needed updating for ALLOW→PERMIT)
• Wire the admin-ui Policies page against this; verify the list renders descriptions and the test dialog roundtrips a PERMIT policy.

What's next in this series

Final closures: Tenants (status enum + createdAt + PUT /{id}/status), Diagnostics + Settings field rename.