grpcctl: add auth login and policy commands

- Add auth/login and auth/logout to mciasgrpcctl, calling
  the existing AuthService.Login/Logout RPCs; password is
  always prompted interactively (term.ReadPassword), never
  accepted as a flag, raw bytes zeroed after use
- Add proto/mcias/v1/policy.proto with PolicyService
  (List, Create, Get, Update, Delete policy rules)
- Regenerate gen/mcias/v1/ stubs to include policy
- Implement internal/grpcserver/policyservice.go delegating
  to the same db layer as the REST policy handlers
- Register PolicyService in grpcserver.go
- Add policy list/create/get/update/delete to mciasgrpcctl
- Update mciasgrpcctl man page with new commands

Security: auth login uses the same interactive password
prompt pattern as mciasctl; password never appears in
process args, shell history, or logs; raw bytes zeroed
after string conversion (same as REST CLI and REST server).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

cmd/mciasctl/main.go

@@ -10,7 +10,7 @@
 //
 // Global flags:
 //
-//	-server  URL of the mciassrv instance (default: https://localhost:8443)
+//	-server  URL of the mciassrv instance (default: https://mcias.metacircular.net:8443)
 //	-token   Bearer token for authentication (or set MCIAS_TOKEN env var)
 //	-cacert  Path to CA certificate for TLS verification (optional)
 //
@@ -61,7 +61,7 @@ import (
 
 func main() {
 	// Global flags.
-	serverURL := flag.String("server", "https://localhost:8443", "mciassrv base URL")
+	serverURL := flag.String("server", "https://mcias.metacircular.net:8443", "mciassrv base URL")
 	tokenFlag := flag.String("token", "", "bearer token (or set MCIAS_TOKEN)")
 	caCert := flag.String("cacert", "", "path to CA certificate for TLS")
 	flag.Usage = usage
@@ -871,7 +871,7 @@ func usage() {
 Usage: mciasctl [global flags] <command> [args]
 
 Global flags:
-  -server  URL of the mciassrv instance (default: https://localhost:8443)
+  -server  URL of the mciassrv instance (default: https://mcias.metacircular.net:8443)
   -token   Bearer token (or set MCIAS_TOKEN env var)
   -cacert  Path to CA certificate for TLS verification