Implement M5: hardening, input validation, and Vite+React+TS dashboard

Backend hardening:
- Fix 6 nginx.go non-constant format string build errors
- Add validation.go with hostname, PEM, and enum validators
- Apply input validation to all POST/PUT handlers (certificates,
  agents, CSR, policies, teams, owners, targets, issuers)
- Fix unchecked JSON decode in TriggerDeployment handler

Frontend (Vite + React + TypeScript):
- Migrate from single-file SPA to proper build pipeline
- 7 pages: Dashboard, Certificates (list+detail), Agents, Jobs,
  Notifications, Policies, Audit Trail
- TanStack Query for server state with auto-refetch intervals
- Certificate detail with version history and renewal trigger
- Job cancellation, status/type filtering, expiry countdowns
- Reusable components: DataTable, StatusBadge, ErrorState, PageHeader
- Dark theme with Tailwind CSS, sidebar nav via React Router

Server integration:
- Go server serves web/dist/ (Vite output) with SPA fallback
- Falls back to web/index.html for legacy mode
- .gitignore updated for web/node_modules/ and web/dist/

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

web/src/pages/PoliciesPage.tsx

@@ -0,0 +1,64 @@
+import { useQuery } from '@tanstack/react-query';
+import { getPolicies } from '../api/client';
+import PageHeader from '../components/PageHeader';
+import DataTable from '../components/DataTable';
+import type { Column } from '../components/DataTable';
+import ErrorState from '../components/ErrorState';
+import { formatDateTime } from '../api/utils';
+import type { PolicyRule } from '../api/types';
+
+const severityStyles: Record<string, string> = {
+  low: 'badge-info',
+  medium: 'badge-warning',
+  high: 'badge-danger',
+  critical: 'badge-danger',
+};
+
+export default function PoliciesPage() {
+  const { data, isLoading, error, refetch } = useQuery({
+    queryKey: ['policies'],
+    queryFn: () => getPolicies(),
+  });
+
+  const columns: Column<PolicyRule>[] = [
+    {
+      key: 'name',
+      label: 'Rule',
+      render: (p) => (
+        <div>
+          <div className="font-medium text-slate-200">{p.name}</div>
+          <div className="text-xs text-slate-500">{p.id}</div>
+        </div>
+      ),
+    },
+    { key: 'type', label: 'Type', render: (p) => <span className="text-sm text-slate-300">{p.type.replace(/_/g, ' ')}</span> },
+    {
+      key: 'severity',
+      label: 'Severity',
+      render: (p) => <span className={`badge ${severityStyles[p.severity] || 'badge-neutral'}`}>{p.severity}</span>,
+    },
+    {
+      key: 'enabled',
+      label: 'Enabled',
+      render: (p) => (
+        <span className={p.enabled ? 'text-emerald-400' : 'text-slate-500'}>
+          {p.enabled ? 'Yes' : 'No'}
+        </span>
+      ),
+    },
+    { key: 'created', label: 'Created', render: (p) => <span className="text-xs text-slate-400">{formatDateTime(p.created_at)}</span> },
+  ];
+
+  return (
+    <>
+      <PageHeader title="Policies" subtitle={data ? `${data.total} rules` : undefined} />
+      <div className="flex-1 overflow-y-auto">
+        {error ? (
+          <ErrorState error={error as Error} onRetry={() => refetch()} />
+        ) : (
+          <DataTable columns={columns} data={data?.data || []} isLoading={isLoading} emptyMessage="No policy rules" />
+        )}
+      </div>
+    </>
+  );
+}