Add PG creds + policy/tags UI; fix lint and build

- internal/ui/ui.go: add PGCred, Tags to AccountDetailData; register
  PUT /accounts/{id}/pgcreds and PUT /accounts/{id}/tags routes; add
  pgcreds_form.html and tags_editor.html to shared template set; remove
  unused AccountTagsData; fix fieldalignment on PolicyRuleView, PoliciesData
- internal/ui/handlers_accounts.go: add handleSetPGCreds — encrypts
  password via crypto.SealAESGCM, writes audit EventPGCredUpdated, renders
  pgcreds_form fragment; password never echoed; load PG creds and tags in
  handleAccountDetail
- internal/ui/handlers_policy.go: fix handleSetAccountTags to render with
  AccountDetailData instead of removed AccountTagsData
- internal/ui/ui_test.go: add 5 PG credential UI tests
- web/templates/fragments/pgcreds_form.html: new fragment — metadata display
  + set/replace form; system accounts only; password write-only
- web/templates/fragments/tags_editor.html: new fragment — textarea editor
  with HTMX PUT for atomic tag replacement
- web/templates/fragments/policy_form.html: rewrite to use structured fields
  matching handleCreatePolicyRule (roles/account_types/actions multi-select,
  resource_type, subject_uuid, service_names, required_tags, checkbox)
- web/templates/policies.html: new policies management page
- web/templates/fragments/policy_row.html: new HTMX table row with toggle
  and delete
- web/templates/account_detail.html: add Tags card and PG Credentials card
- web/templates/base.html: add Policies nav link
- internal/server/server.go: remove ~220 lines of duplicate tag/policy
  handler code (real implementations are in handlers_policy.go)
- internal/policy/engine_wrapper.go: fix corrupted source; use errors.New
- internal/db/policy_test.go: use model.AccountTypeHuman constant
- cmd/mciasctl/main.go: add nolint:gosec to int(os.Stdin.Fd()) calls
- gofmt/goimports: db/policy_test.go, policy/defaults.go,
  policy/engine_test.go, ui/ui.go, cmd/mciasctl/main.go
- fieldalignment: model.PolicyRuleRecord, policy.Engine, policy.Rule,
  policy.RuleBody, ui.PolicyRuleView
Security: PG password encrypted AES-256-GCM with fresh random nonce before
storage; plaintext never logged or returned in any response; audit event
written on every credential write.

internal/ui/ui.go

@@ -171,6 +171,9 @@ func New(database *db.DB, cfg *config.Config, priv ed25519.PrivateKey, pub ed255
 		"templates/fragments/error.html",
 		"templates/fragments/audit_rows.html",
 		"templates/fragments/pgcreds_form.html",
+		"templates/fragments/tags_editor.html",
+		"templates/fragments/policy_row.html",
+		"templates/fragments/policy_form.html",
 	}
 	base, err := template.New("").Funcs(funcMap).ParseFS(web.TemplateFS, sharedFiles...)
 	if err != nil {
@@ -186,6 +189,7 @@ func New(database *db.DB, cfg *config.Config, priv ed25519.PrivateKey, pub ed255
 		"account_detail": "templates/account_detail.html",
 		"audit":          "templates/audit.html",
 		"audit_detail":   "templates/audit_detail.html",
+		"policies":       "templates/policies.html",
 	}
 	tmpls := make(map[string]*template.Template, len(pageFiles))
 	for name, file := range pageFiles {
@@ -263,6 +267,11 @@ func (u *UIServer) Register(mux *http.ServeMux) {
 	uiMux.Handle("GET /audit", adminGet(u.handleAuditPage))
 	uiMux.Handle("GET /audit/rows", adminGet(u.handleAuditRows))
 	uiMux.Handle("GET /audit/{id}", adminGet(u.handleAuditDetail))
+	uiMux.Handle("GET /policies", adminGet(u.handlePoliciesPage))
+	uiMux.Handle("POST /policies", admin(u.handleCreatePolicyRule))
+	uiMux.Handle("PATCH /policies/{id}/enabled", admin(u.handleTogglePolicyRule))
+	uiMux.Handle("DELETE /policies/{id}", admin(u.handleDeletePolicyRule))
+	uiMux.Handle("PUT /accounts/{id}/tags", admin(u.handleSetAccountTags))
 
 	// Mount the wrapped UI mux on the parent mux. The "/" pattern acts as a
 	// catch-all for all UI paths; the more-specific /v1/ API patterns registered
@@ -509,6 +518,7 @@ type AccountDetailData struct {
 	PageData
 	Roles    []string
 	AllRoles []string
+	Tags     []string
 	Tokens   []*model.TokenRecord
 }
 
@@ -528,3 +538,21 @@ type AuditDetailData struct {
 	Event *db.AuditEventView
 	PageData
 }
+
+// PolicyRuleView is a single policy rule prepared for template rendering.
+type PolicyRuleView struct {
+	Description string
+	RuleJSON    string
+	CreatedAt   string
+	UpdatedAt   string
+	ID          int64
+	Priority    int
+	Enabled     bool
+}
+
+// PoliciesData is the view model for the policies list page.
+type PoliciesData struct {
+	PageData
+	Rules      []*PolicyRuleView
+	AllActions []string
+}