Add policy CRUD, cert management, and web UI updates

- Add PUT /v1/policy/rule endpoint for updating policy rules; expose
  full policy CRUD through the web UI with a dedicated policy page
- Add certificate revoke, delete, and get-cert to CA engine and wire
  REST + gRPC routes; fix missing interceptor registrations
- Update ARCHITECTURE.md to reflect v2 gRPC as the active implementation,
  document ACME endpoints, correct CA permission levels, and add policy/cert
  management route tables
- Add POLICY.md documenting the priority-based ACL engine design
- Add web/templates/policy.html for policy management UI

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/config/config.go

@@ -48,8 +48,9 @@ type DatabaseConfig struct {
 
 // MCIASConfig holds MCIAS integration settings.
 type MCIASConfig struct {
-	ServerURL string `toml:"server_url"`
-	CACert    string `toml:"ca_cert"`
+	ServerURL    string `toml:"server_url"`
+	CACert       string `toml:"ca_cert"`
+	ServiceToken string `toml:"service_token"`
 }
 
 // SealConfig holds Argon2id parameters for the seal process.