grpcctl: add auth login and policy commands

- Add auth/login and auth/logout to mciasgrpcctl, calling
  the existing AuthService.Login/Logout RPCs; password is
  always prompted interactively (term.ReadPassword), never
  accepted as a flag, raw bytes zeroed after use
- Add proto/mcias/v1/policy.proto with PolicyService
  (List, Create, Get, Update, Delete policy rules)
- Regenerate gen/mcias/v1/ stubs to include policy
- Implement internal/grpcserver/policyservice.go delegating
  to the same db layer as the REST policy handlers
- Register PolicyService in grpcserver.go
- Add policy list/create/get/update/delete to mciasgrpcctl
- Update mciasgrpcctl man page with new commands

Security: auth login uses the same interactive password
prompt pattern as mciasctl; password never appears in
process args, shell history, or logs; raw bytes zeroed
after string conversion (same as REST CLI and REST server).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

README.md

@@ -149,7 +149,7 @@ MCIAS_MASTER_PASSPHRASE=your-passphrase mciassrv -config /etc/mcias/mcias.conf
 ### 6. Verify
 
 ```sh
-curl -k https://localhost:8443/v1/health
+curl -k https://mcias.metacircular.net:8443/v1/health
 # {"status":"ok"}
 ```
 
@@ -173,11 +173,11 @@ make docker     # build Docker image mcias:<version>
 ## Admin CLI (mciasctl)
 
 ```sh
-TOKEN=$(curl -sk https://localhost:8443/v1/auth/login \
+TOKEN=$(curl -sk https://mcias.metacircular.net:8443/v1/auth/login \
   -d '{"username":"admin","password":"..."}' | jq -r .token)
 export MCIAS_TOKEN=$TOKEN
 
-mciasctl -server https://localhost:8443 account list
+mciasctl -server https://mcias.metacircular.net:8443 account list
 mciasctl account create -username alice          # password prompted interactively
 mciasctl role set -id $UUID -roles admin
 mciasctl token issue -id $SYSTEM_UUID
@@ -245,7 +245,7 @@ See `man mciasgrpcctl` and [ARCHITECTURE.md](ARCHITECTURE.md) §17.
 ## Web Management UI
 
 mciassrv includes a built-in web interface for day-to-day administration.
-After starting the server, navigate to `https://localhost:8443/login` and
+After starting the server, navigate to `https://mcias.metacircular.net:8443/login` and
 log in with an admin account.
 
 The UI provides:
@@ -278,7 +278,7 @@ docker run -d \
   -p 9443:9443 \
   mcias:latest
 
-curl -k https://localhost:8443/v1/health
+curl -k https://mcias.metacircular.net:8443/v1/health
 ```
 
 The container runs as uid 10001 (mcias) with no capabilities.