Policies: enforce on upload or export (#6614)

Follow-up to #6604 (merged). Builds the Security policy out so it
actually enforces, driven from the editor.

## What it does
- **Run on upload or export** — a single choice in the wizard: enforce
when a file is uploaded, or just before it's exported.
- **Output** — enforced result is a **new version** of the file
(default) or a **new file**, with optional filename
prefix/suffix/auto-number ("Output filename" subsection; auto-number
only for new files).
- **Export enforcement** — exporting an export-mode file runs the policy
first and downloads the enforced result; never hard-blocks (on failure
the original downloads). For new-version policies the in-editor file is
versioned too. Covers every export path incl. multi-file ZIP. A toast
(glowing in the policy's accent while it runs) reports progress and
fades after ~10s.
- **Affordances** — a freshly enforced file briefly glows its policy
accent and carries a shield badge.
- **Config tidy-up** — removed the unwired Security setting fields + the
wizard's review step; "Upgrade to enterprise" on locked categories;
category accent in the detail/wizard headers.

## Notes
- Builds on the manual-only (client-driven) policy model from #6587
(`trigger: null`, metadata in `output.options`), adding the `runOn`
field + export-time enforcement.
- The page-editor merge-export (no single source file) enforces +
downloads but doesn't version in place.

## Verification
typecheck (core + proprietary), eslint, prettier; proprietary suite
(105) green; flows checked in-app.

frontend/editor/src/proprietary/components/policies/usePolicyAutoRun.ts

@@ -73,14 +73,19 @@ export function usePolicyAutoRun(): void {
   useEffect(() => {
     if (!POLICIES_ENABLED) return;
     const active = Object.entries(policies).filter(
-      ([, s]) => s.configured && s.status === "active" && s.backendId,
+      ([, s]) =>
+        s.configured &&
+        s.status === "active" &&
+        s.backendId &&
+        // Only auto-run on upload when the policy is set to run on upload
+        // (export-triggered policies enforce at export time instead).
+        (s.runOn ?? "upload") === "upload",
     );
     for (const [categoryId, s] of active) {
       for (const stub of fileStubs) {
         const key = dispatchKey(categoryId, stub.id);
-        // Skip if already run (persisted) or a dispatch is mid-flight (this
-        // session) — runPolicyOnFile now waits for the file's bytes to commit,
-        // so the in-memory guard, not an eager mark, prevents double-firing.
+        // Skip if already run (persisted) or a dispatch is in flight — the
+        // in-memory guard prevents double-firing during the async wait.
         if (isDispatched(categoryId, stub.id) || dispatching.current.has(key)) {
           continue;
         }