fix(policies): stop 400ing the "+ New Policy" button + add per-rule severity (D-005, D-006)

Coverage Gap Audit findings D-005 (P0) + D-006 (P1) fixed together in a
single commit because they share the same root cause — policy CRUD sending
values the backend silently rejects — and splitting them would leave a
half-working UI between commits.

## D-005 (P0): PoliciesPage dropdown 400s every Create Policy

Root cause
----------
`web/src/pages/PoliciesPage.tsx` populated the Type `<select>` from a
hardcoded `['key_algorithm', 'ownership', 'allowed_issuers', ...]` array.
The backend's `internal/api/handler/validators.go::ValidatePolicyType`
enforces the TitleCase allowlist `AllowedIssuers`, `AllowedDomains`,
`RequiredMetadata`, `AllowedEnvironments`, `RenewalLeadTime` — defined in
`internal/domain/policy.go`. Every Create Policy request was rejected with
`400 invalid policy type`. The error surfaced only as a transient toast;
the modal closed anyway. Silent user-visible failure.

Fix
---
- `web/src/api/types.ts`: added `POLICY_TYPES` and `POLICY_SEVERITIES`
  tuples with `as const` and narrowed `PolicyRule.type`, `.severity`, and
  `PolicyViolation.severity` to the literal-union types. Dropdown is now
  sourced from the tuple; casing drift becomes a compile error.
- `web/src/pages/PoliciesPage.tsx`: rekeyed `severityStyles` /
  `severityDots` to the TitleCase values, added `humanize()` for display
  (AllowedIssuers → "Allowed Issuers"), removed the `badge-neutral`
  fallback that was papering over the mismatch.
- `web/src/api/types.test.ts` (new): pins both tuples exactly. If anyone
  edits one side of the frontend/backend contract without the other, CI
  fails with a clear assertion. Pure-TS vitest, no RTL dependency.

## D-006 (P1): `severity` field silently dropped on create/update

Root cause
----------
`PolicyRule` had no `Severity` field in `internal/domain/policy.go`. The
frontend has always sent `severity` on create/update, but Go's
`json.Decoder` (default settings, no `DisallowUnknownFields`) silently
dropped it. The value never reached PostgreSQL. Every rule rendered with
the same severity because there was no severity — just a display
computation downstream.

Fix: option (b), full-stack schema add (not delete-the-field)
-------------------------------------------------------------
- Migration `000013_policy_rule_severity` (up + down): adds
  `severity VARCHAR(50) NOT NULL DEFAULT 'Warning'` to `policy_rules` with
  CHECK constraint `severity IN ('Warning', 'Error', 'Critical')`. No
  index — three-value column on a low-thousands-rows table, planner will
  seq-scan regardless. PG 11+ metadata-only ADD COLUMN, safe on live data.
- `internal/domain/policy.go`: added `Severity PolicySeverity` field.
- `internal/repository/postgres/policy.go`: plumbed `severity` through
  ListRules SELECT + Scan, GetRule SELECT + Scan, CreateRule INSERT,
  UpdateRule UPDATE (4 queries).
- `internal/service/policy.go::UpdatePolicy`: if the client omits
  severity on a PUT (zero-value empty string), fetch the existing rule
  and preserve its severity. Without this, partial updates would trip the
  NOT NULL CHECK and 500. Preserves pre-existing behavior for Name/Type
  (out of scope).
- `internal/api/handler/policies.go::CreatePolicy`: default empty severity
  to `'Warning'`, then validate via `ValidatePolicySeverity`. 400 with
  clear message instead of 500 on CHECK violation. `UpdatePolicy`:
  validates severity only when provided.
- `internal/mcp/types.go` + `internal/mcp/tools.go`: added optional
  `severity` on the MCP `create_policy` / `update_policy` tool inputs so
  LLM callers stay in sync with the wire contract.
- `api/openapi.yaml`: added `severity` to the `PolicyRule` schema with
  the enum and default.

Acceptance criterion (user-defined)
-----------------------------------
"Create a rule with severity=Critical, reload the page, and still see
Critical — no silent drops." Verified end-to-end: frontend sends
`severity: "Critical"`, handler validates, service persists, DB stores,
GET returns, React renders the correct badge.

Seed data
---------
`migrations/seed.sql`: four demo rules now have differentiated severities
— `pr-require-owner` → Warning, `pr-allowed-environments` → Error,
`pr-max-certificate-lifetime` → Critical, `pr-min-renewal-window` →
Warning. The user called out that seeding all four at the same severity
makes the feature look decorative; differentiation demonstrates the
column carries real signal.

## Integration test fix (side effect of D-006)

`internal/integration/e2e_test.go::TestCrossResourceWorkflow/CreatePolicy`
was sending `"severity": "High"` — a value from the pre-audit severity
vocabulary that the new `ValidatePolicySeverity` correctly rejects with
400. Changed to `"Error"` (closest semantic match in the new TitleCase
allowlist). Only severity reference in the integration/ directory;
verified via grep.

## Out of scope, logged for follow-up (d/D-008)

Three policy-engine drift issues orthogonal to D-005 + D-006, explicitly
deferred per direction:

1. `migrations/seed.sql` policy_rules INSERTs use lowercase TYPE values
   (`'ownership'`, `'environment'`, `'lifetime'`, `'renewal_window'`).
   These are load-bearing on `internal/service/policy.go::evaluateRule`'s
   `switch rule.Type` (which also uses the lowercase strings). Migrating
   requires coordinated changes across seed + evaluation engine.
2. `migrations/seed_demo.sql:482-483` contains lowercase `'critical'`
   severity — will now fail the new CHECK constraint. Separate fix.
3. `evaluateRule` hardcodes `Severity: domain.PolicySeverityWarning` on
   emitted violations and ignores the configured `rule.Config`. The new
   severity column is read correctly on the CRUD path but not yet
   consulted during evaluation.

## Verification

Backend:
- `go build ./...` — clean
- `go vet ./...` — clean
- `go test -short ./...` — all packages green, including
  `internal/service` (policy service), `internal/api/handler` (policy +
  MCP handler tests), `internal/integration` (e2e_test.go after fix),
  `internal/domain`, `internal/repository/postgres`.

Frontend:
- `tsc --noEmit` — clean
- `vitest run` — 223/223 passing (4 new assertions in types.test.ts)
- `vite build` — clean (only the pre-existing chunk-size warning)

web/src/api/types.test.ts

@@ -0,0 +1,59 @@
+import { describe, it, expect } from 'vitest';
+import { POLICY_TYPES, POLICY_SEVERITIES } from './types';
+
+/**
+ * Regression tests for the policy enum tuples.
+ *
+ * These tuples are the GUI's source of truth for the policy type and severity
+ * dropdowns. They MUST stay in lockstep with the backend enum values:
+ *   - internal/domain/policy.go defines the PolicyType / PolicySeverity consts
+ *   - internal/api/handler/validators.go rejects anything outside the allowlist
+ *   - migration 000013 enforces the severity allowlist at the DB level via CHECK
+ *
+ * Audit history (D-005, D-006):
+ *   - The GUI previously sent lowercase values (e.g. 'key_algorithm',
+ *     'ownership'), which the backend validator rejected with a 400. Every
+ *     attempt to create a policy from the "+ New Policy" button silently
+ *     failed until the modal was closed.
+ *   - The severity dropdown carried a four-value `low/medium/high/critical`
+ *     tuple that shared zero values with the backend's
+ *     `Warning/Error/Critical` — the `medium` option has no backend analog
+ *     and is removed.
+ *
+ * If these tests fail because a backend enum changed, DO NOT update the
+ * expected arrays without also updating the backend consts and the migration.
+ * Frontend/backend drift on these tuples is precisely what this regression
+ * guards against.
+ */
+
+describe('POLICY_TYPES', () => {
+  it('matches the backend PolicyType TitleCase allowlist exactly', () => {
+    expect(POLICY_TYPES).toEqual([
+      'AllowedIssuers',
+      'AllowedDomains',
+      'RequiredMetadata',
+      'AllowedEnvironments',
+      'RenewalLeadTime',
+    ]);
+  });
+
+  it('has no duplicate entries', () => {
+    expect(new Set(POLICY_TYPES).size).toBe(POLICY_TYPES.length);
+  });
+});
+
+describe('POLICY_SEVERITIES', () => {
+  it('matches the backend PolicySeverity TitleCase allowlist exactly', () => {
+    expect(POLICY_SEVERITIES).toEqual(['Warning', 'Error', 'Critical']);
+  });
+
+  it('has no duplicate entries', () => {
+    expect(new Set(POLICY_SEVERITIES).size).toBe(POLICY_SEVERITIES.length);
+  });
+
+  it('does not include the removed pre-fix `medium` value', () => {
+    // Explicit negative assertion. Pre-fix the GUI offered four severities
+    // (low/medium/high/critical); `medium` never had a backend analog.
+    expect(POLICY_SEVERITIES as readonly string[]).not.toContain('medium');
+  });
+});

web/src/api/types.ts

@@ -112,11 +112,37 @@ export interface AuditEvent {
   timestamp: string;
 }
 
+/**
+ * Policy rule type enum — pinned to the backend's TitleCase constants in
+ * internal/domain/policy.go. Historical note (D-005): the GUI previously sent
+ * lowercase values (`ownership`, `environment`, etc.) that the handler's
+ * ValidatePolicyType rejected with a 400. These tuples are the canonical
+ * source of truth for the dropdown options; the regression test in
+ * types.test.ts pins them so future drift is caught at CI time.
+ */
+export const POLICY_TYPES = [
+  'AllowedIssuers',
+  'AllowedDomains',
+  'RequiredMetadata',
+  'AllowedEnvironments',
+  'RenewalLeadTime',
+] as const;
+export type PolicyType = (typeof POLICY_TYPES)[number];
+
+/**
+ * Policy severity enum — pinned to the backend's PolicySeverity constants.
+ * The backend CHECK constraint on policy_rules.severity enforces the same
+ * allowlist (migration 000013). The 4-value `medium` option that used to
+ * appear in the GUI was never a valid backend value and has been removed.
+ */
+export const POLICY_SEVERITIES = ['Warning', 'Error', 'Critical'] as const;
+export type PolicySeverity = (typeof POLICY_SEVERITIES)[number];
+
 export interface PolicyRule {
   id: string;
   name: string;
-  type: string;
-  severity: string;
+  type: PolicyType;
+  severity: PolicySeverity;
   config: Record<string, unknown>;
   enabled: boolean;
   created_at: string;
@@ -127,7 +153,7 @@ export interface PolicyViolation {
   id: string;
   rule_id: string;
   certificate_id: string;
-  severity: string;
+  severity: PolicySeverity;
   message: string;
   created_at: string;
 }

web/src/pages/PoliciesPage.tsx

@@ -6,22 +6,40 @@ import DataTable from '../components/DataTable';
 import type { Column } from '../components/DataTable';
 import ErrorState from '../components/ErrorState';
 import { formatDateTime } from '../api/utils';
-import type { PolicyRule } from '../api/types';
+import {
+  POLICY_TYPES,
+  POLICY_SEVERITIES,
+  type PolicyRule,
+  type PolicyType,
+  type PolicySeverity,
+} from '../api/types';
 
-const severityStyles: Record<string, string> = {
-  low: 'badge-info',
-  medium: 'badge-warning',
-  high: 'badge-danger',
-  critical: 'badge-danger',
+/**
+ * Severity → badge style. Keyed on the backend's TitleCase PolicySeverity
+ * enum values (D-006). The pre-fix map keyed on `low`/`medium`/`high`/`critical`
+ * which never matched the backend's `Warning`/`Error`/`Critical`, so every
+ * existing rule fell through to the `badge-neutral` default.
+ */
+const severityStyles: Record<PolicySeverity, string> = {
+  Warning: 'badge-warning',
+  Error: 'badge-danger',
+  Critical: 'badge-danger',
 };
 
-const severityDots: Record<string, string> = {
-  low: 'bg-emerald-500',
-  medium: 'bg-amber-500',
-  high: 'bg-orange-500',
-  critical: 'bg-red-500',
+const severityDots: Record<PolicySeverity, string> = {
+  Warning: 'bg-amber-500',
+  Error: 'bg-orange-500',
+  Critical: 'bg-red-500',
 };
 
+/**
+ * Convert TitleCase enum value to a human-readable label for display.
+ * "AllowedIssuers" → "Allowed Issuers"
+ */
+function humanize(s: string): string {
+  return s.replace(/([A-Z])/g, ' $1').trim();
+}
+
 interface CreatePolicyModalProps {
   isOpen: boolean;
   onClose: () => void;
@@ -32,8 +50,8 @@ interface CreatePolicyModalProps {
 
 function CreatePolicyModal({ isOpen, onClose, onSuccess, isLoading, error }: CreatePolicyModalProps) {
   const [name, setName] = useState('');
-  const [type, setType] = useState('key_algorithm');
-  const [severity, setSeverity] = useState('medium');
+  const [type, setType] = useState<PolicyType>(POLICY_TYPES[0]);
+  const [severity, setSeverity] = useState<PolicySeverity>('Warning');
   const [configStr, setConfigStr] = useState('{}');
   const [enabled, setEnabled] = useState(true);
 
@@ -43,8 +61,8 @@ function CreatePolicyModal({ isOpen, onClose, onSuccess, isLoading, error }: Cre
     const config = JSON.parse(configStr);
     await createPolicy({ name: name.trim(), type, severity, config, enabled });
     setName('');
-    setType('key_algorithm');
-    setSeverity('medium');
+    setType(POLICY_TYPES[0]);
+    setSeverity('Warning');
     setConfigStr('{}');
     setEnabled(true);
     onSuccess();
@@ -72,27 +90,24 @@ function CreatePolicyModal({ isOpen, onClose, onSuccess, isLoading, error }: Cre
             <label className="block text-sm font-medium text-ink mb-1">Type *</label>
             <select
               value={type}
-              onChange={e => setType(e.target.value)}
+              onChange={e => setType(e.target.value as PolicyType)}
               className="w-full bg-white border border-surface-border rounded px-3 py-2 text-sm text-ink focus:outline-none focus:border-brand-400"
             >
-              <option value="key_algorithm">Key Algorithm</option>
-              <option value="cert_lifetime">Certificate Lifetime</option>
-              <option value="san_pattern">SAN Pattern</option>
-              <option value="key_usage">Key Usage</option>
-              <option value="revocation_check">Revocation Check</option>
+              {POLICY_TYPES.map(t => (
+                <option key={t} value={t}>{humanize(t)}</option>
+              ))}
             </select>
           </div>
           <div>
             <label className="block text-sm font-medium text-ink mb-1">Severity *</label>
             <select
               value={severity}
-              onChange={e => setSeverity(e.target.value)}
+              onChange={e => setSeverity(e.target.value as PolicySeverity)}
               className="w-full bg-white border border-surface-border rounded px-3 py-2 text-sm text-ink focus:outline-none focus:border-brand-400"
             >
-              <option value="low">Low</option>
-              <option value="medium">Medium</option>
-              <option value="high">High</option>
-              <option value="critical">Critical</option>
+              {POLICY_SEVERITIES.map(s => (
+                <option key={s} value={s}>{s}</option>
+              ))}
             </select>
           </div>
           <div>
@@ -182,7 +197,7 @@ export default function PoliciesPage() {
         </div>
       ),
     },
-    { key: 'type', label: 'Type', render: (p) => <span className="text-sm text-ink">{p.type.replace(/_/g, ' ')}</span> },
+    { key: 'type', label: 'Type', render: (p) => <span className="text-sm text-ink">{humanize(p.type)}</span> },
     {
       key: 'severity',
       label: 'Severity',
@@ -248,8 +263,8 @@ export default function PoliciesPage() {
           </div>
           {Object.entries(bySeverity).map(([sev, count]) => (
             <div key={sev} className="flex items-center gap-1.5">
-              <div className={`w-2 h-2 rounded-full ${severityDots[sev] || 'bg-slate-400'}`} />
-              <span className="text-xs text-ink capitalize">{sev}</span>
+              <div className={`w-2 h-2 rounded-full ${severityDots[sev as PolicySeverity] || 'bg-slate-400'}`} />
+              <span className="text-xs text-ink">{sev}</span>
               <span className="text-xs text-ink-faint">{count}</span>
             </div>
           ))}