Summary

Activates UserPolicyPage by adding GET + PUT /api/users/{name}/policy — the write side of the RBAC management surface, complementing the read-side simulator (#3228). Today the page is a stub linking to "after M3 ships". M3 (feat(security): RBAC M3 — per-user tool policy + memory namespace ACL) is merged in main; this PR connects the management plane.

Surface

• GET /api/users/{name}/policy — owner-only. Returns the user's current tool_policy, tool_categories, memory_access, channel_tool_rules from UserConfig.
• PUT /api/users/{name}/policy — owner-only. Body shape:

  {
    "tool_policy": { "allowed_tools": [...], "denied_tools": [...] } | null | <omitted>,
    "tool_categories": { ... } | null | <omitted>,
    "memory_access": { ... } | null | <omitted>,
    "channel_tool_rules": { "telegram": {...}, ... } | <omitted>
  }

  Each field is independently nullable. null clears, omitted preserves — this distinction is critical and required deserializing the body as serde_json::Map rather than the typed struct (Option<T> collapses both into None).
• Owner-only inherited from existing is_owner_only_write middleware allowlist (/api/users/* with non-GET method) — no new gate code, just a new route under the existing umbrella.

Validation

• Tool / namespace strings: nonempty, no whitespace-only entries
• No duplicate entries within a single list
• memory_access.writable_namespaces ⊆ readable_namespaces — newly enforced at this layer with a comment noting there's no upstream check today and the kernel resolver assumes well-formed config
• Unknown top-level keys rejected so a typo (tool_polices) can't silently no-op into "preserve everything"

Dashboard

• UserPolicyPage rewritten from stub to a 4-section editor: tool allow/deny lists, tool categories, memory access (with PII checkbox), per-channel rules. Client-side validation mirrors server.
• useUpdateUserPolicy invalidates permissionPolicyKeys.detail(name) + userKeys.detail(name) + userKeys.lists() on success.
• PermissionPolicy type rewritten to match the real wire shape (the previous one was an M3-stub guess written before the endpoint shipped — same root cause as feat(dashboard): activate AuditPage now that M5 audit endpoints shipped #3225 / feat(api): per-user budget write/clear endpoints + dashboard editor #3224 / feat(security): RBAC effective-permissions snapshot — wire simulator (#3054) #3228).

Test plan

• Unit-style: users_policy_get_round_trip, users_policy_put_replaces_only_specified_fields, users_policy_put_validates_writable_subset_of_readable, users_policy_put_validates_no_empty_tool_strings — 4/4 pass.
• Full-stack through the auth middleware: users_policy_put_owner_only — Admin caller (not Owner) blocked at the middleware → 403.
• No regressions in surrounding tests: users_test 16/16, api_integration_test -- test_audit test_user_budget 4/4 (all M5 surface still passes).
• cargo check -p librefang-api -p librefang-kernel -p librefang-types clean; cargo clippy -p librefang-api --tests -- -D warnings clean.
• Dashboard pnpm build + pnpm typecheck clean (no new errors; pre-existing errors in sessions-stream.test.tsx unrelated).
• Live: not run against a real daemon. The integration test goes through the full middleware + handler + persist_users + reload chain on a real axum server, which is the meaningful end-to-end coverage; spinning up the daemon is operator-validation rather than CI.

Out-of-scope follow-ups noted

• UserItem doesn't yet expose policy fields, so the userKeys invalidation is defensive — no UI today reads policy off UserItem. Costs nothing to leave in.
• Channel rules editor only exposes 4 default platforms (telegram/discord/slack/email); arbitrary channel names work in the API but the UI needs a "+ add channel" button to surface them. Not in this slice.
• update_user_policy doesn't add its own RoleChange audit row — persist_users emits a generic config-change row. Could add a finer-grained record like update_user_budget does; stylistic, not a bug.

Refs #3054.