feat: add memindadm runtime policy for agent code runs (Phase 1.5)

Persist code-run gates in admin DB and expose them via /auth/status so H5 can honor runtime policy without VITE rebuilds.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/types.ts

@@ -905,6 +905,14 @@ export type PolicyDefinition = {
   risk: 'low' | 'medium' | 'high';
 };
 
+export type AgentCodeRunClientPolicy = {
+  codeRun?: {
+    enabled?: boolean;
+    pageDataDevAutodetect?: boolean;
+    generalAutodetect?: boolean;
+  };
+};
+
 export type AuthStatus = {
   authenticated: boolean;
   mode?: 'user' | 'legacy' | 'none' | 'unavailable';
@@ -913,6 +921,7 @@ export type AuthStatus = {
   capabilities?: CapabilityMap;
   grantedSkills?: string[];
   unrestricted?: boolean;
+  agentCodeRun?: AgentCodeRunClientPolicy | null;
 };
 
 export type PathGrant = {