feat(catalog): add policy service and admin API

[erichare]

Summary

Adds the central catalog-policy decision service, process-local snapshot cache, and superuser administration API on top of the catalog-policy schema PR.

• add an LFX policy contract with immutable component/template block snapshots and default-allow single/batch decisions
• add the Langflow database-backed implementation with startup hydration and post-commit atomic snapshot publication
• add whole-set GET/PUT endpoints for /api/v1/catalog-policy/components and /api/v1/catalog-policy/templates
• require an active superuser for every catalog-policy read/write
• normalize, deduplicate, and deterministically order keys while preserving case and accepting not-yet-installed catalog keys
• emit one post-commit catalog:block / catalog:unblock audit event per changed key
• keep standalone LFX and unavailable/broken policy implementations fail-open with a stable allow-all fallback

Jira

• Epic: LE-1864
• Implements: LE-1933
• Implements: LE-1935

Validation

• backend catalog policy service/API tests — 18 passed
• isolated LFX catalog policy tests — 3 passed
• Ruff and pre-commit hooks — passed
• code review — no findings after fail-open fallback hardening
• API security review — superuser gating and input/SQL handling clean

Operational note

The ticket specifies an in-process cache. A successful write invalidates and replaces the snapshot in the worker handling that request; sibling workers hydrate at startup and require a future distributed invalidation/version-polling mechanism for immediate cross-worker coherence. The API uses the existing audit_decision pipeline, so persistence follows the existing AUTHZ_AUDIT_ENABLED setting.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (1)

• release-.*

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 95d09b34-5078-492f-9489-a7829a1ad2dd

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Test Coverage Advisor

No source changes detected without accompanying tests. Thanks for keeping coverage up! 🎉

Advisory check only — never blocks merge.