feat(api, web): implement policy mode management for agents and rules

- Added support for policy modes ('blacklist' and 'whitelist') in agent and policy set management.
- Updated API endpoints to handle policy mode during agent assignment and rule operations.
- Enhanced the web UI to display and manage policy modes for agents and rules, ensuring all assigned sets share a consistent mode.
- Introduced new validation to enforce single policy mode across assigned sets for agents.
- Improved error handling for policy mode conflicts and updated documentation accordingly.

Co-authored-by: Cursor <[email protected]>

packages/db/migrations/005_policy_set_mode.sql

@@ -0,0 +1,15 @@
+-- Mode on policy sets + per-rule enabled
+
+ALTER TABLE policy_sets ADD COLUMN policy_mode TEXT NOT NULL DEFAULT 'blacklist';
+
+ALTER TABLE policy_rules ADD COLUMN enabled INTEGER NOT NULL DEFAULT 1;
+
+-- Backfill set mode from agents that use the set (prefer whitelist if any agent has it)
+UPDATE policy_sets
+SET policy_mode = 'whitelist'
+WHERE id IN (
+  SELECT DISTINCT aps.set_id
+  FROM agent_policy_sets aps
+  INNER JOIN agents a ON a.id = aps.agent_id
+  WHERE a.policy_mode = 'whitelist'
+);