Add group-scoped policy layers

[knhn1004]

Summary

• add group-policy YAML loading with inheritance, user overlays, deny-overrides, and priority conflict handling
• thread session user/group identity through API and CLI, and surface policy traces in ledger/dashboard views
• document OAL-73 architecture, schema, API fields, and status updates

Validation

• go test ./internal/policy ./internal/api
• bun test ./tests/rules.test.ts
• bun run typecheck (cli)
• bun run typecheck (dashboard-ui)
• bun run build (dashboard-ui)
• git diff --check

Linear: OAL-73