Phase 1: modern policy model bridge (grants/nodeAttrs-ready)

[CJFWeatherhead]

Summary

Implements Phase 1 from docs/headscale-0.29.x-agentic-workplan.md with minimal, phase-bounded changes.

What changed

• Added modern policy type definitions in src/lib/common/policy-types.ts.
• Extended policy parse/merge/serialise utilities to support known 0.29.x sections:
  • grants, nodeAttrs, tests, sshTests, postures, randomizeClientPort
• Adapted ACLBuilder into a broader bridge model by adding storage + getters/setters for modern policy sections while preserving existing ACL methods and workflows.
• Added PolicyBuilder bridge export (src/lib/common/policy-builder.ts) so future UI migration can use a policy-centric name without breakage.
• Updated ACL route copy to present the screen as Policy Builder while keeping ACL tabs unchanged.
• Updated and added unit tests for modern policy parsing/round-trip and builder behaviour.

Why

This provides a modern policy-capable source of truth for the model layer while preserving existing ACL tabs/flows and maintaining compatibility.

Tests run

• vitest src/lib/common/policy-document.test.ts src/lib/common/policy-builder.test.ts ✅
• vitest src/index.test.ts ✅

(Executed in a node:20-alpine container due host npm absence.)

Non-goals in this PR

• No new grants/nodeAttrs editing UI yet (Phase 2).
• No SSH check-mode/auth workflow changes (Phase 3).
• No docs hardening/e2e expansion (Phase 4).