Policies: let team leaders configure policies in the UI (#6634)

Frontend follow-up to #6632 (team-scoped policies, editing gated to team
leaders on the backend). Brings the UI's edit gate in line.

## Problem
The policy config UI gated editing to `config.isAdmin`. On SaaS, org
users are never the single global admin, so **no one could open the
policy editor** — the same lockout #6632 fixed on the backend.

## Fix
`usePolicies` now allows a **team leader** to configure, falling back to
a global admin self-hosted:

```ts
canConfigure =
  config != null && (!config.enableLogin || isTeamLeader || config.isAdmin === true);
```

- SaaS → `isTeamLeader` (from `useSaaSTeam()`) — team leaders can
configure; members get the read-only surface.
- Self-hosted → `config.isAdmin` (the core `useSaaSTeam` stub returns
`false`, so admins aren't locked out).
- Login disabled (single-user) → always allowed.
- The `config != null` guard keeps the gate closed until app-config
resolves, so edit controls never flash for users who can't use them.

The two locked-policy banners now read "Contact a team leader to change
this policy" (updated in the `t()` defaults and the `en-GB`
translations).

## Verification
- Typecheck clean (proprietary + saas); eslint clean.
- Tests pass: `usePolicies`, `PoliciesSidebar`.

frontend/editor/public/locales/en-GB/translation.toml

@@ -5869,7 +5869,7 @@ security = "Security"
 [policies.detail]
 editSettings = "Edit Settings"
 enforces = "Enforces"
-managedByOrg = "Managed by your organization. Contact an admin to change this policy."
+managedByOrg = "Managed by your organization. Contact a team leader to change this policy."
 noActivityDescription = "Documents will appear here once this policy runs."
 noActivityTitle = "No activity yet"
 onEveryUpload = "On every upload"
@@ -5931,7 +5931,7 @@ filenamePrefix = "Prefix"
 filenameSuffix = "Suffix"
 filenameTextAria = "Filename text"
 filenameTextPlaceholder = "Text to add (optional)"
-lockedDescription = "Contact an admin to change this policy."
+lockedDescription = "Contact a team leader to change this policy."
 lockedTitle = "Managed by your organization"
 maxRetriesLabel = "Max retries"
 noToolsError = "Add at least one configured tool to the workflow first."