fix(policies): stop 400ing the "+ New Policy" button + add per-rule severity (D-005, D-006)

Coverage Gap Audit findings D-005 (P0) + D-006 (P1) fixed together in a
single commit because they share the same root cause — policy CRUD sending
values the backend silently rejects — and splitting them would leave a
half-working UI between commits.

## D-005 (P0): PoliciesPage dropdown 400s every Create Policy

Root cause
----------
`web/src/pages/PoliciesPage.tsx` populated the Type `<select>` from a
hardcoded `['key_algorithm', 'ownership', 'allowed_issuers', ...]` array.
The backend's `internal/api/handler/validators.go::ValidatePolicyType`
enforces the TitleCase allowlist `AllowedIssuers`, `AllowedDomains`,
`RequiredMetadata`, `AllowedEnvironments`, `RenewalLeadTime` — defined in
`internal/domain/policy.go`. Every Create Policy request was rejected with
`400 invalid policy type`. The error surfaced only as a transient toast;
the modal closed anyway. Silent user-visible failure.

Fix
---
- `web/src/api/types.ts`: added `POLICY_TYPES` and `POLICY_SEVERITIES`
  tuples with `as const` and narrowed `PolicyRule.type`, `.severity`, and
  `PolicyViolation.severity` to the literal-union types. Dropdown is now
  sourced from the tuple; casing drift becomes a compile error.
- `web/src/pages/PoliciesPage.tsx`: rekeyed `severityStyles` /
  `severityDots` to the TitleCase values, added `humanize()` for display
  (AllowedIssuers → "Allowed Issuers"), removed the `badge-neutral`
  fallback that was papering over the mismatch.
- `web/src/api/types.test.ts` (new): pins both tuples exactly. If anyone
  edits one side of the frontend/backend contract without the other, CI
  fails with a clear assertion. Pure-TS vitest, no RTL dependency.

## D-006 (P1): `severity` field silently dropped on create/update

Root cause
----------
`PolicyRule` had no `Severity` field in `internal/domain/policy.go`. The
frontend has always sent `severity` on create/update, but Go's
`json.Decoder` (default settings, no `DisallowUnknownFields`) silently
dropped it. The value never reached PostgreSQL. Every rule rendered with
the same severity because there was no severity — just a display
computation downstream.

Fix: option (b), full-stack schema add (not delete-the-field)
-------------------------------------------------------------
- Migration `000013_policy_rule_severity` (up + down): adds
  `severity VARCHAR(50) NOT NULL DEFAULT 'Warning'` to `policy_rules` with
  CHECK constraint `severity IN ('Warning', 'Error', 'Critical')`. No
  index — three-value column on a low-thousands-rows table, planner will
  seq-scan regardless. PG 11+ metadata-only ADD COLUMN, safe on live data.
- `internal/domain/policy.go`: added `Severity PolicySeverity` field.
- `internal/repository/postgres/policy.go`: plumbed `severity` through
  ListRules SELECT + Scan, GetRule SELECT + Scan, CreateRule INSERT,
  UpdateRule UPDATE (4 queries).
- `internal/service/policy.go::UpdatePolicy`: if the client omits
  severity on a PUT (zero-value empty string), fetch the existing rule
  and preserve its severity. Without this, partial updates would trip the
  NOT NULL CHECK and 500. Preserves pre-existing behavior for Name/Type
  (out of scope).
- `internal/api/handler/policies.go::CreatePolicy`: default empty severity
  to `'Warning'`, then validate via `ValidatePolicySeverity`. 400 with
  clear message instead of 500 on CHECK violation. `UpdatePolicy`:
  validates severity only when provided.
- `internal/mcp/types.go` + `internal/mcp/tools.go`: added optional
  `severity` on the MCP `create_policy` / `update_policy` tool inputs so
  LLM callers stay in sync with the wire contract.
- `api/openapi.yaml`: added `severity` to the `PolicyRule` schema with
  the enum and default.

Acceptance criterion (user-defined)
-----------------------------------
"Create a rule with severity=Critical, reload the page, and still see
Critical — no silent drops." Verified end-to-end: frontend sends
`severity: "Critical"`, handler validates, service persists, DB stores,
GET returns, React renders the correct badge.

Seed data
---------
`migrations/seed.sql`: four demo rules now have differentiated severities
— `pr-require-owner` → Warning, `pr-allowed-environments` → Error,
`pr-max-certificate-lifetime` → Critical, `pr-min-renewal-window` →
Warning. The user called out that seeding all four at the same severity
makes the feature look decorative; differentiation demonstrates the
column carries real signal.

## Integration test fix (side effect of D-006)

`internal/integration/e2e_test.go::TestCrossResourceWorkflow/CreatePolicy`
was sending `"severity": "High"` — a value from the pre-audit severity
vocabulary that the new `ValidatePolicySeverity` correctly rejects with
400. Changed to `"Error"` (closest semantic match in the new TitleCase
allowlist). Only severity reference in the integration/ directory;
verified via grep.

## Out of scope, logged for follow-up (d/D-008)

Three policy-engine drift issues orthogonal to D-005 + D-006, explicitly
deferred per direction:

1. `migrations/seed.sql` policy_rules INSERTs use lowercase TYPE values
   (`'ownership'`, `'environment'`, `'lifetime'`, `'renewal_window'`).
   These are load-bearing on `internal/service/policy.go::evaluateRule`'s
   `switch rule.Type` (which also uses the lowercase strings). Migrating
   requires coordinated changes across seed + evaluation engine.
2. `migrations/seed_demo.sql:482-483` contains lowercase `'critical'`
   severity — will now fail the new CHECK constraint. Separate fix.
3. `evaluateRule` hardcodes `Severity: domain.PolicySeverityWarning` on
   emitted violations and ignores the configured `rule.Config`. The new
   severity column is read correctly on the CRUD path but not yet
   consulted during evaluation.

## Verification

Backend:
- `go build ./...` — clean
- `go vet ./...` — clean
- `go test -short ./...` — all packages green, including
  `internal/service` (policy service), `internal/api/handler` (policy +
  MCP handler tests), `internal/integration` (e2e_test.go after fix),
  `internal/domain`, `internal/repository/postgres`.

Frontend:
- `tsc --noEmit` — clean
- `vitest run` — 223/223 passing (4 new assertions in types.test.ts)
- `vite build` — clean (only the pre-existing chunk-size warning)

web/src/api/types.test.ts

@@ -0,0 +1,59 @@
+import { describe, it, expect } from 'vitest';
+import { POLICY_TYPES, POLICY_SEVERITIES } from './types';
+
+/**
+ * Regression tests for the policy enum tuples.
+ *
+ * These tuples are the GUI's source of truth for the policy type and severity
+ * dropdowns. They MUST stay in lockstep with the backend enum values:
+ *   - internal/domain/policy.go defines the PolicyType / PolicySeverity consts
+ *   - internal/api/handler/validators.go rejects anything outside the allowlist
+ *   - migration 000013 enforces the severity allowlist at the DB level via CHECK
+ *
+ * Audit history (D-005, D-006):
+ *   - The GUI previously sent lowercase values (e.g. 'key_algorithm',
+ *     'ownership'), which the backend validator rejected with a 400. Every
+ *     attempt to create a policy from the "+ New Policy" button silently
+ *     failed until the modal was closed.
+ *   - The severity dropdown carried a four-value `low/medium/high/critical`
+ *     tuple that shared zero values with the backend's
+ *     `Warning/Error/Critical` — the `medium` option has no backend analog
+ *     and is removed.
+ *
+ * If these tests fail because a backend enum changed, DO NOT update the
+ * expected arrays without also updating the backend consts and the migration.
+ * Frontend/backend drift on these tuples is precisely what this regression
+ * guards against.
+ */
+
+describe('POLICY_TYPES', () => {
+  it('matches the backend PolicyType TitleCase allowlist exactly', () => {
+    expect(POLICY_TYPES).toEqual([
+      'AllowedIssuers',
+      'AllowedDomains',
+      'RequiredMetadata',
+      'AllowedEnvironments',
+      'RenewalLeadTime',
+    ]);
+  });
+
+  it('has no duplicate entries', () => {
+    expect(new Set(POLICY_TYPES).size).toBe(POLICY_TYPES.length);
+  });
+});
+
+describe('POLICY_SEVERITIES', () => {
+  it('matches the backend PolicySeverity TitleCase allowlist exactly', () => {
+    expect(POLICY_SEVERITIES).toEqual(['Warning', 'Error', 'Critical']);
+  });
+
+  it('has no duplicate entries', () => {
+    expect(new Set(POLICY_SEVERITIES).size).toBe(POLICY_SEVERITIES.length);
+  });
+
+  it('does not include the removed pre-fix `medium` value', () => {
+    // Explicit negative assertion. Pre-fix the GUI offered four severities
+    // (low/medium/high/critical); `medium` never had a backend analog.
+    expect(POLICY_SEVERITIES as readonly string[]).not.toContain('medium');
+  });
+});

web/src/api/types.ts

@@ -112,11 +112,37 @@ export interface AuditEvent {
   timestamp: string;
 }
 
+/**
+ * Policy rule type enum — pinned to the backend's TitleCase constants in
+ * internal/domain/policy.go. Historical note (D-005): the GUI previously sent
+ * lowercase values (`ownership`, `environment`, etc.) that the handler's
+ * ValidatePolicyType rejected with a 400. These tuples are the canonical
+ * source of truth for the dropdown options; the regression test in
+ * types.test.ts pins them so future drift is caught at CI time.
+ */
+export const POLICY_TYPES = [
+  'AllowedIssuers',
+  'AllowedDomains',
+  'RequiredMetadata',
+  'AllowedEnvironments',
+  'RenewalLeadTime',
+] as const;
+export type PolicyType = (typeof POLICY_TYPES)[number];
+
+/**
+ * Policy severity enum — pinned to the backend's PolicySeverity constants.
+ * The backend CHECK constraint on policy_rules.severity enforces the same
+ * allowlist (migration 000013). The 4-value `medium` option that used to
+ * appear in the GUI was never a valid backend value and has been removed.
+ */
+export const POLICY_SEVERITIES = ['Warning', 'Error', 'Critical'] as const;
+export type PolicySeverity = (typeof POLICY_SEVERITIES)[number];
+
 export interface PolicyRule {
   id: string;
   name: string;
-  type: string;
-  severity: string;
+  type: PolicyType;
+  severity: PolicySeverity;
   config: Record<string, unknown>;
   enabled: boolean;
   created_at: string;
@@ -127,7 +153,7 @@ export interface PolicyViolation {
   id: string;
   rule_id: string;
   certificate_id: string;
-  severity: string;
+  severity: PolicySeverity;
   message: string;
   created_at: string;
 }