9fa1f0cc51
Policies and roots were editable only via SQL inside the container. Full CRUD over both, validated against the vocabulary the policy engine knows — unknown resolutions or sources answer 422 naming the field, malformed JSON answers 422, deleting a referenced policy or an occupied root answers 409. Closes #116 (API half).