feat(policy): rule builder and mandatory dry-run sandbox

Task 09 shipped a powerful API that a non-technical clinic owner could not
safely use. This closes that gap: activation now requires having seen what the
rule actually does.

- PolicySimulator runs a policy against real past appointments and writes
  nothing: evaluation works on facts (never entities), the whole run sits in a
  transaction rolled back and cleared in `finally`, and a test counts rows in
  five sensitive tables before and after
- activate() now demands a simulation of the *same version* — a report for
  version 1 does not unlock version 2
- PolicyTemplateRegistry: six ready-made rules, so the common case never
  touches a raw condition
- Severity from the affected ratio; 0% is a warning too, since a rule that
  changes nothing usually has a condition that never matches
- An empty clinic still succeeds with a warning, otherwise a new clinic could
  never activate anything

Admin: PoliciesPage, PolicyFormPage, PolicySimulationPage, and a
PolicyConditionBuilder built entirely from GET /policy-schema — a test proves a
field that exists only in the schema shows up with no frontend change, and that
operators are filtered per field type.

The schema response now carries per-field metadata (label, type, meaningful
operators) so the form has one source of truth instead of two.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

assets/admin/components/layout/SettingsLayout.tsx

@@ -2,7 +2,7 @@ import React from 'react';
 import {
   CreditCardIcon, UserIcon, CalendarDaysIcon, BuildingOffice2Icon,
   BanknotesIcon, UsersIcon, ShieldCheckIcon,
-  TagIcon, ChatBubbleLeftRightIcon, UserCircleIcon, UserPlusIcon, ReceiptPercentIcon, MapPinIcon, CubeIcon,
+  TagIcon, ChatBubbleLeftRightIcon, UserCircleIcon, UserPlusIcon, ReceiptPercentIcon, MapPinIcon, CubeIcon, ScaleIcon,
 } from '@heroicons/react/24/outline';
 import PurchaseSubscriptionSidebar from './PurchaseSubscriptionSidebar';
 
@@ -32,6 +32,7 @@ export const SETTINGS_MENU: SettingsMenuItem[] = [
   { key: 'branches',     label: 'شعبه‌ها و اتاق‌ها',   icon: MapPinIcon,               to: '/admin/branches',             roles: ['doctor', 'clinic'], perm: ['appointment_settings', 'view'] },
   { key: 'resources',    label: 'منابع',              icon: CubeIcon,                 to: '/admin/resources',            roles: ['doctor', 'clinic'], perm: ['appointment_settings', 'view'] },
   { key: 'holidays',     label: 'تعطیلات رسمی',       icon: CalendarDaysIcon,         to: '/admin/holidays',             roles: ['doctor', 'clinic'], perm: ['appointment_settings', 'view'] },
+  { key: 'policies',     label: 'قوانین',             icon: ScaleIcon,                to: '/admin/policies',             roles: ['doctor', 'clinic'], perm: ['appointment_settings', 'view'] },
   { key: 'payment',      label: 'مدیریت پرداخت',      icon: BanknotesIcon,            to: '/admin/my-financial',         perm: ['payments', 'view'] },
   { key: 'secretary',    label: 'مدیریت منشی',        icon: UsersIcon,                to: '/admin/my-secretaries' },
   { key: 'staff',        label: 'پرسنل',              icon: UserPlusIcon,             to: '/admin/staff',                perm: ['staff', 'view'] },