feat(api): policy and root CRUD endpoints

Policies and roots were editable only via SQL inside the container.
Full CRUD over both, validated against the vocabulary the policy
engine knows — unknown resolutions or sources answer 422 naming the
field, malformed JSON answers 422, deleting a referenced policy or an
occupied root answers 409. Closes #116 (API half).

crates/arr-api/src/movies.rs

@@ -112,6 +112,8 @@ pub enum ApiError {
     SeasonNotFound,
     EpisodeNotFound,
     OwnerNotFound,
+    PolicyNotFound,
+    RootNotFound,
     Conflict(String),
     Invalid(String),
     Unavailable,
@@ -130,6 +132,8 @@ impl IntoResponse for ApiError {
             Self::SeasonNotFound => (StatusCode::NOT_FOUND, "season not found".to_string()),
             Self::EpisodeNotFound => (StatusCode::NOT_FOUND, "episode not found".to_string()),
             Self::OwnerNotFound => (StatusCode::NOT_FOUND, "owner not found".to_string()),
+            Self::PolicyNotFound => (StatusCode::NOT_FOUND, "policy not found".to_string()),
+            Self::RootNotFound => (StatusCode::NOT_FOUND, "root not found".to_string()),
             Self::Conflict(error) => (StatusCode::CONFLICT, error),
             Self::Invalid(error) => (StatusCode::UNPROCESSABLE_ENTITY, error),
             Self::Unavailable => (