refactor(backend): replica guard helper for security routes (#797)

* refactor(backend): extract replica guard helper for security routes

Adds blockIfReplica(res, resource) in middleware/fleetSyncGuards.ts and
replaces six inline FleetSyncService.getRole() === 'replica' checks
across the security policies and CVE suppressions endpoints.

Error responses now use a uniform shape:
  403 { error: 'Cannot modify <resource> on a replica instance.
    Connect to the primary.', code: 'REPLICA_READ_ONLY' }

The new code field gives callers a stable discriminator without
matching prose.

Closes #750

* test(suppressions): match stable REPLICA_READ_ONLY code instead of prose

The replica guard helper exposes a stable code field for callers to
discriminate without grepping the human-readable error string. Switch
the replica-rejection assertion to use that code so the test no longer
breaks when the unified error template wording is tuned.

backend/src/__tests__/suppression-routes.test.ts

@@ -140,7 +140,7 @@ describe('POST /api/security/suppressions', () => {
       .set('Authorization', adminAuthHeader)
       .send(validBody);
     expect(res.status).toBe(403);
-    expect(res.body.error).toMatch(/control node/i);
+    expect(res.body.code).toBe('REPLICA_READ_ONLY');
   });
 
   it('rejects malformed CVE identifiers', async () => {