feat: add memindadm runtime policy for agent code runs (Phase 1.5)

Persist code-run gates in admin DB and expose them via /auth/status so H5 can honor runtime policy without VITE rebuilds.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/api/client.ts

@@ -42,6 +42,7 @@ import type {
 } from '../types';
 import { normalizeConversationMessages, normalizeUserMessageForApi } from '../utils/message';
 import type { AgentRunCreateOptions, AgentRunValidation } from '../utils/agentRunMode';
+import { applyAgentCodeRunClientPolicy } from '../utils/agentRunMode';
 import {
   API,
   ApiError,
@@ -319,6 +320,7 @@ export async function checkAuth(): Promise<AuthStatus> {
       return { authenticated: false };
     }
     if (status.authenticated) resetUnauthorizedGuard();
+    applyAgentCodeRunClientPolicy(status.agentCodeRun ?? null);
     if (status.authenticated && status.mode === 'user' && !status.capabilities) {
       try {
         const me = await getMe();