Add policy-based authz and token delegation

- Replace requireAdmin (role-based) guards on all REST endpoints
  with RequirePolicy middleware backed by the existing policy engine;
  built-in admin wildcard rule (-1) preserves existing admin behaviour
  while operator rules can now grant targeted access to non-admin
  accounts (e.g. a system account allowed to list accounts)
- Wire policy engine into Server: loaded from DB at startup,
  reloaded after every policy-rule create/update/delete so changes
  take effect immediately without a server restart
- Add service_account_delegates table (migration 000008) so a human
  account can be delegated permission to issue tokens for a specific
  system account without holding the admin role
- Add token-download nonce mechanism: a short-lived (5 min),
  single-use random nonce is stored server-side after token issuance;
  the browser downloads the token as a file via
  GET /token/download/{nonce} (Content-Disposition: attachment)
  instead of copying from a flash message
- Add /service-accounts UI page for non-admin delegates
- Add TestPolicyEnforcement and TestPolicyDenyRule integration tests

Security:
- Policy engine uses deny-wins, default-deny semantics; admin wildcard
  is a compiled-in built-in and cannot be deleted via the API
- Token download nonces are 128-bit crypto/rand values, single-use,
  and expire after 5 minutes; a background goroutine evicts stale entries
- alg header validation and Ed25519 signing unchanged

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/server/handlers_policy.go

@@ -217,6 +217,9 @@ func (s *Server) handleCreatePolicyRule(w http.ResponseWriter, r *http.Request)
 	s.writeAudit(r, model.EventPolicyRuleCreated, createdBy, nil,
 		fmt.Sprintf(`{"rule_id":%d,"description":%q}`, rec.ID, rec.Description))
 
+	// Reload the in-memory engine so the new rule takes effect immediately.
+	s.reloadPolicyEngine()
+
 	rv, err := policyRuleToResponse(rec)
 	if err != nil {
 		middleware.WriteError(w, http.StatusInternalServerError, "internal error", "internal_error")
@@ -325,6 +328,9 @@ func (s *Server) handleUpdatePolicyRule(w http.ResponseWriter, r *http.Request)
 	s.writeAudit(r, model.EventPolicyRuleUpdated, actorID, nil,
 		fmt.Sprintf(`{"rule_id":%d}`, rec.ID))
 
+	// Reload the in-memory engine so rule changes take effect immediately.
+	s.reloadPolicyEngine()
+
 	updated, err := s.db.GetPolicyRule(rec.ID)
 	if err != nil {
 		middleware.WriteError(w, http.StatusInternalServerError, "internal error", "internal_error")
@@ -358,6 +364,9 @@ func (s *Server) handleDeletePolicyRule(w http.ResponseWriter, r *http.Request)
 	s.writeAudit(r, model.EventPolicyRuleDeleted, actorID, nil,
 		fmt.Sprintf(`{"rule_id":%d,"description":%q}`, rec.ID, rec.Description))
 
+	// Reload the in-memory engine so the deleted rule is removed immediately.
+	s.reloadPolicyEngine()
+
 	w.WriteHeader(http.StatusNoContent)
 }