Add L7 policies for user-agent blocking and required headers

Per-route HTTP-level blocking policies for L7 routes. Two rule types:
block_user_agent (substring match against User-Agent, returns 403)
and require_header (named header must be present, returns 403).

Config: L7Policy struct with type/value fields, added as L7Policies
slice on Route. Validated in config (type enum, non-empty value,
warning if set on L4 routes).

DB: Migration 4 creates l7_policies table with route_id FK (cascade
delete), type CHECK constraint, UNIQUE(route_id, type, value). New
l7policies.go with ListL7Policies, CreateL7Policy, DeleteL7Policy,
GetRouteID. Seed updated to persist policies from config.

L7 middleware: PolicyMiddleware in internal/l7/policy.go evaluates
rules in order, returns 403 on first match, no-op if empty. Composed
into the handler chain between context injection and reverse proxy.

Server: L7PolicyRule type on RouteInfo with AddL7Policy/RemoveL7Policy
mutation methods on ListenerState. handleL7 threads policies into
l7.RouteConfig. Startup loads policies per L7 route from DB.

Proto: L7Policy message, repeated l7_policies on Route. Three new
RPCs: ListL7Policies, AddL7Policy, RemoveL7Policy. All follow the
write-through pattern.

Client: L7Policy type, ListL7Policies/AddL7Policy/RemoveL7Policy
methods. CLI: mcproxyctl policies list/add/remove subcommands.

Tests: 6 PolicyMiddleware unit tests (no policies, UA match/no-match,
header present/absent, multiple rules). 4 DB tests (CRUD, cascade,
duplicate, GetRouteID). 3 gRPC tests (add+list, remove, validation).
2 end-to-end L7 tests (UA block, required header with allow/deny).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

PROGRESS.md

@@ -60,14 +60,14 @@ proceeds. Each item is marked:
 
 ## Phase 7: L7 Policies
 
-- [ ] 7.1 Config: `L7Policy` struct, `L7Policies` on Route, validation
-- [ ] 7.2 DB: migration 4, `l7_policies` table, CRUD in `l7policies.go`
-- [ ] 7.3 L7 middleware: `PolicyMiddleware` in `internal/l7/policy.go`
-- [ ] 7.4 Server/L7 integration: thread policies from RouteInfo to RouteConfig
-- [ ] 7.5 Proto/gRPC: `L7Policy` message, policy management RPCs
-- [ ] 7.6 Client/CLI: policy methods, `mcproxyctl policies` subcommand
-- [ ] 7.7 Startup: load L7 policies per route in `loadListenersFromDB`
-- [ ] 7.8 Tests: middleware unit, DB CRUD + cascade, gRPC round-trip, e2e
+- [x] 7.1 Config: `L7Policy` struct, `L7Policies` on Route, validation
+- [x] 7.2 DB: migration 4, `l7_policies` table, CRUD in `l7policies.go`
+- [x] 7.3 L7 middleware: `PolicyMiddleware` in `internal/l7/policy.go`
+- [x] 7.4 Server/L7 integration: thread policies from RouteInfo to RouteConfig
+- [x] 7.5 Proto/gRPC: `L7Policy` message, policy management RPCs
+- [x] 7.6 Client/CLI: policy methods, `mcproxyctl policies` subcommand
+- [x] 7.7 Startup: load L7 policies per route in `loadListenersFromDB`
+- [x] 7.8 Tests: middleware unit, DB CRUD + cascade, gRPC round-trip, e2e
 
 ## Phase 8: Prometheus Metrics