[BUG] MUT-007: Hosted Policies page still calls retired 410 APIs #60

Problem

P0-3 / M-PR8E removed Hosted policy filesystem access. The Hosted Policies page still GET /api/policies and /api/policies/content. Those routes always call require_hosted_filesystem_access_removed() and return 410 hosted_filesystem_access_removed.

Why it matters

Hosted “Policies” nav is broken for every user after M-PR8E. There are zero UI tests (MUT-026), so CI stayed green.

Evidence

• Audit ID: MUT-007 (HIGH, confirmed).
• apps/api/src/mutiny_api/app.py — policy FS routes always 410.
• apps/web/src/app/policies/page.tsx L53–56 still fetches list + content.
• apps/web/src/lib/api.ts policies / policyContent / savePolicyContent.
• AppShell still links to Policies.
• Audit TestClient: GET /api/policies and /api/policies/content → 410.

Related #47 is empty-state copy for policies/tests (sample vs project). This issue is the 410 API calls themselves — coordinate copy with #47 if you hide the page.

Reproduction

Audit: TestClient 410 vs web still calling those endpoints. Browser click-through of Policies was not independently re-verified in this filing pass.

Expected behavior

Policies nav either (a) shows ingest/policy metadata that Hosted actually has, or (b) is hidden/replaced with observe-only copy that does not call retired FS APIs. No 410 error as the default Policies experience.

Suggested implementation direction

Point the UI at ingest policy metadata (policy_id / policy_version on campaigns) or hide the page and the AppShell link. Stop calling retired endpoints. Do not restore Hosted FS access.

Acceptance criteria

• Hosted UI does not call /api/policies or /api/policies/content on load of the nav item (or the nav item is gone).
• 410 FS-removal API behavior remains (do not resurrect Hosted policy file I/O).
• User-visible Policies experience is either ingest metadata or an explicit observe-only empty state (see frontend: clearer empty-state copy for policies/tests (sample vs project) #47).
• At least one web unit/component test or API client test that the retired endpoints are not used from the page module.
• Campaigns / tests / observe-only ingest flows unchanged.

Scope

apps/web Policies page + shell link. Out of scope: restoring FS APIs; MUT-009 sample README copy (separate docs issue); #47 empty-state wording unless you touch the same page.

Related audit findings

MUT-007. Related: MUT-009 / MUT-054 / MUT-065 (leftover Hosted-exec copy), MUT-026 (no UI tests), #47.

Contributor notes

Generated from the Mutiny deep audit.

help wanted. Frontend. Not a good-first-issue if you invent a new metadata UI; hiding the nav is small but needs a product choice — state the choice in the PR.