Follow-up #2/5. #16 added wire-shape fields reason and matchedRules to PolicyTestResponse but had to leave them as nulls / empty lists because the Policy SPI only returned a PolicyDecision enum. This PR promotes the SPI so policies can actually surface detail.

SPI additions (access-api)

• PolicyEvaluation record: { decision, reason, matchedRules }. Factory methods permit(reason, rules) / deny(reason, rules) / notApplicable(reason) / of(decision) keep call-sites readable and matchedRules immutable + non-null.
• Policy.evaluateDetailed(context) — new default method. The default delegates to evaluate(context) so legacy policies that only implement the coarse entry point still produce a valid PolicyEvaluation (null reason + empty matched rules). Override evaluateDetailed directly when the policy has detail worth surfacing.
• PolicyEvaluator.evaluateDetailed(name, context) — matching default. Delegates to evaluate by default; DefaultPolicyEvaluator overrides it to dispatch through Policy.evaluateDetailed.

Evaluator (access-core)

• DefaultPolicyEvaluator.evaluateDetailed:
  • policyName == null → PolicyEvaluation.notApplicable("policyName was null")
  • unknown name → PolicyEvaluation.notApplicable("no policy registered for name: " + name)
  • match → policy.evaluateDetailed(context)

Controller (admin-api)

• PolicyAdminController.test now calls evaluator.evaluateDetailed and forwards decision / reason / matchedRules into PolicyTestResponse. Wire shape unchanged — policies that don't override evaluateDetailed still respond cleanly with null reason + empty list.
• Javadoc on PolicyTestResponse updated to explain the new semantics (no longer "placeholders today").

Backward compatibility

• Every existing Policy implementation continues to compile and behave identically — they only have to override evaluate, and evaluateDetailed wraps that result automatically.
• PolicyEvaluator.evaluate is unchanged, so callers that don't care about reason / matchedRules keep working.

Test plan

• ./gradlew build green (55 tasks, all tests pass — DefaultPolicyEvaluatorTest didn't need any change because its policies override evaluate)
• Manual: implement a policy that overrides evaluateDetailed to return permit("matched-role-admin", List.of("rule-role-admin")), hit /policies/test in the admin UI, verify the reason + matched rules render in the dialog