feat(policies): backend-driven policy enforcement (frontend) (#6598)

## Summary
Adds the **Policies** feature (proprietary, behind the
`POLICIES_ENABLED` flag): backend-driven enforcement that runs a fixed
tool pipeline on documents, docked in the right tool sidebar alongside
Tools.

## Highlights
- **Policy catalog** — 5 categories; **Security** is wired (redact PII +
sanitize), the others are marked "Coming soon".
- **Backend as source of truth** — policies persist via the Policies
engine (`/api/v1/policies`), one policy per category, with a local cache
+ offline fallback.
- **Auto-run** — enabled policies run on every uploaded file: dispatch →
poll → import outputs into the workspace.
- **Security redact config** — PII preset dropdown + custom word/regex
entry + advanced options; tool params map to the backend endpoint
fields.
- **Activity feed** with retry on failures; **file badges** showing
which policies ran on a file (sidebar + files page), tinted to the
policy colour.
- Reuses the **Watched Folders** engine for each policy's backing
folder; policy-owned folders are filtered out of the Watched Folders UI.

## Notes
- Gated by `POLICIES_ENABLED` (true in proprietary, false in core) —
unreachable in the open-source build.
- Frontend-only diff; depends on the backend Policies engine and the
merged Watched Folders feature.

frontend/.storybook/main.ts

@@ -1,12 +1,14 @@
 import { resolve } from "node:path";
 import type { StorybookConfig } from "@storybook/react-vite";
+import tsconfigPaths from "vite-tsconfig-paths";
 
 /**
  * Storybook 9 ships essentials, interactions, and docs as built-ins, so the
  * addon list is just the extras we want: theme switching + a11y auditing.
  *
- * Story files live next to their components in shared/ and portal/src/.
- * MDX docs pages live in portal/src/docs/.
+ * Story files live next to their components in shared/, portal/src/, and
+ * editor/src/ — the design system is shared by BOTH apps, so both surface
+ * their stories here. MDX docs pages live in portal/src/docs/.
  */
 const config: StorybookConfig = {
   stories: [
@@ -14,6 +16,7 @@ const config: StorybookConfig = {
     "../portal/src/**/*.stories.@(ts|tsx)",
     "../shared/**/*.mdx",
     "../shared/**/*.stories.@(ts|tsx)",
+    "../editor/src/**/*.stories.@(ts|tsx)",
   ],
   addons: ["@storybook/addon-themes", "@storybook/addon-a11y"],
   framework: {
@@ -28,13 +31,26 @@ const config: StorybookConfig = {
   staticDirs: ["../portal/public"],
   viteFinal: async (config) => {
     // Wire @portal/* and @shared/* aliases directly on the Storybook bundler so
-    // story imports resolve without needing the portal's vite config.
+    // portal story imports resolve without needing the portal's vite config.
     config.resolve = config.resolve ?? {};
     config.resolve.alias = {
       ...(config.resolve.alias ?? {}),
       "@portal": resolve(__dirname, "../portal/src"),
       "@shared": resolve(__dirname, "../shared"),
     };
+    // Editor stories import via @app/* (proprietary→core fallback), @core/* and
+    // @proprietary/*. Resolve them exactly the way the editor's own build does —
+    // through vite-tsconfig-paths against the proprietary vite tsconfig — so the
+    // shared Storybook can host editor components without duplicating the alias
+    // map here.
+    config.plugins = config.plugins ?? [];
+    config.plugins.push(
+      tsconfigPaths({
+        projects: [
+          resolve(__dirname, "../editor/tsconfig.proprietary.vite.json"),
+        ],
+      }),
+    );
     return config;
   },
 };