Submit a tenant authorization policy

Stores a new version of the caller's tenant policy and validates it. A REJECTED submission is stored too, with the reason: "what did I send that you refused" is the first question support gets, and by then the author no longer has the draft. Validation compiles the Rego against a restricted capability set (no network, no process environment, nothing non-deterministic), checks the package namespace, and runs the policy's own test_ rules. A refused policy still returns 200 — the submission succeeded, the policy failed — with the verdict in validation.