feat: checkbox-based policy creator, batch approve, agent permissions

[nerdsane]

Summary

• Checkbox-based PermissionsMatrix replaces one-at-a-time radio-group policy creator — select multiple entity types and actions at once, create N policies in one click
• Batch approve flow for similar pending decisions on the Decisions page with grouping strategies (by action+resource, agent+action, agent_type+action)
• Agent permissions tab — click "Permissions" on any agent row to manage policies affecting that agent, with enable/disable/delete and inline policy creation
• Tenant-scoped agent fetching — policy creator now filters agents by selected tenant

Test plan

• Navigate to Policies page, click "New Policy", verify checkbox matrix shows entity types and their actions
• Check entity type header → verifies "all actions" mode, check individual actions → verifies per-action mode
• Verify "Create N policies" button count matches selections
• Click "Show Cedar preview" to verify generated policies
• Create policies and verify they appear in the policy list (needs live agent traffic)
• Navigate to Decisions page, toggle "Batch" mode, verify grouping and batch selection
• Select decisions and use "Approve Selected" flow (needs pending decisions)
• Navigate to Agents page, verify "Permissions" button on each row
• Click "Permissions" → verify agent detail policies tab with relevant policies
• Switch tenants in policy creator → verify agent dropdown updates (needs multi-tenant setup)

🤖 Generated with Claude Code