feat(playground): add files policy test harness

[MarioCadenas]

Summary

Stacks on top of files/service-principal-policies to turn the dev-playground into a live test harness for the new FilePolicy system. Lets us deploy the app and visually verify every policy shape works end-to-end against a real Databricks workspace — something that's hard to prove in unit tests because HTTP routes always run as the SP while policies read x-forwarded-user.

One volume per policy shape, all bound to the same underlying UC volume in app.yaml (policies are evaluated in-process, so the shared physical path is fine):

Volume	Policy	What it proves
allow_all	allowAll()	baseline smoke
public_read	publicRead()	writes → 403
deny_all	denyAll()	every action → 403
sp_only	any(isServicePrincipal, publicRead())	SP bypass via combinator (docs example)
admin_only	custom, writes gated on ADMIN_USER_ID	custom FilePolicy with real user IDs
write_only	not(publicRead())	drop-box shape
implicit	(no policy)	v0.21 default + startup warning

/policy-matrix page probes every (volume × action) pair against the real HTTP routes and classifies each result as allowed (2xx), allowed* (404 — policy passed, probe file missing), denied (403), or error. A "Run all" button seeds a probe file per volume via upload first, so reads return real content where policy allows writes.

Three server helpers:

• GET /whoami — echoes x-forwarded-user + admin status (for debugging the auth proxy in the deployed app)
• GET /policy/sp — programmatic SP-path smoke test, confirms PolicyDeniedError propagates from the SDK (not just HTTP 403)
• GET /policy/obo — same but via asUser(req), confirms the OBO path sees the user identity and gets denied as expected

Test plan

• Local: set all seven DATABRICKS_VOLUME_* env vars in apps/dev-playground/.env (all pointing at the same UC volume is fine); pnpm dev; open /policy-matrix; Run all. Expected pattern: deny_all all 403, allow_all all 2xx, write_only reads 403 / writes 2xx, etc.
• Deploy: pnpm deploy:playground; optionally add ADMIN_USER_ID to app.yaml to exercise the admin path. Verify x-forwarded-user is forwarded by hitting /whoami.
• /policy/sp returns denied: true with PolicyDeniedError message for deny_all / write_only entries.
• /policy/obo returns denied: true for deny_all, allowed for public_read.list and sp_only.list.