[5a] Policy editor — admin CRUD + activation

[andrmaz]

What to build

Admin can create, update, activate, and deactivate department policy JSON configurations via a policy editor. The editor validates rule structure before saving so malformed configs never reach the runtime evaluator. Policy records are scoped to a department within an organization.

Acceptance criteria

• Admin can create a policy config (JSON) scoped to a department via POST /api/admin/policies.
• Admin can activate and deactivate a policy version.
• Invalid JSON rule shapes are rejected with validation errors before persisting.
• Admin UI includes a policy editor with validation feedback.
• Only one policy version is active per department at a time.

Blocked by

• [2b] User and department management #5 [2b] User and department management