feat(web): W3-2 library, subscriptions and rules, preferences, decisions inbox, identity and metadata

- library list (kind/status/search, cursor paging) and detail: paths and roots, external identity
  mapping with lock, field-level metadata sources and locks, slot cards with rejection reasons,
  content units (provisional flag), downloads with verification; remap/lock/refresh/merge actions
- subscriptions: list/create/update, slot rules editor (hard/soft/upgrade/completion),
  policy revision draft -> preview -> publish (grant warning) -> rollback
- preferences: tag CRUD, disable/enable, suppression records and lift, history timeline
- inbox: grouped by entity and kind, evidence/suggestion/impact/preview, resolve options, SSE refresh
- identity: pool assign/dismiss/retry, external identity revisions and lock, title alias management
- all responses validated against contracts zod schemas

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/web/app/api/policies.ts

@@ -0,0 +1,64 @@
+import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
+import {
+  cursorPage,
+  PolicyRevision,
+  type PolicyRevisionCreate,
+  type PolicyRevisionUpdate,
+  type PolicyStatus,
+} from "@umt/contracts";
+import { z } from "zod";
+import { api } from "~/lib/api.ts";
+import { getParsed, parseOrThrow } from "./library.ts";
+
+// 策略版本:草案 → 预览 → 授权发布 → 版本化 / 回滚(REQ §6.4)
+
+export const policyKeys = {
+  all: ["policies"] as const,
+  list: (f: PolicyFilters) => ["policies", "list", f] as const,
+};
+
+export type PolicyFilters = { policyKey?: string; status?: PolicyStatus };
+
+const Page = cursorPage(PolicyRevision);
+
+export function usePolicyRevisions(filters: PolicyFilters = {}) {
+  return useQuery({
+    queryKey: policyKeys.list(filters),
+    queryFn: ({ signal }) => getParsed(Page, "/policy-revisions", { ...filters, limit: 200 }, signal),
+  });
+}
+
+/** 预览结果(服务端 previewPolicy 的形状;contracts 里是 JsonObject) */
+export const PolicyPreview = z.object({
+  evaluatedAt: z.string(),
+  sampleSize: z.number(),
+  templates: z.number(),
+  matched: z.number(),
+  excluded: z.number(),
+  samples: z.array(z.object({ sourceReleaseId: z.string(), template: z.string(), decision: z.string() })),
+  valid: z.boolean(),
+});
+export type PolicyPreview = z.infer<typeof PolicyPreview>;
+
+const parse = (d: unknown) => parseOrThrow(PolicyRevision, d, "/policy-revisions");
+
+function useAction<V>(fn: (v: V) => Promise<unknown>) {
+  const qc = useQueryClient();
+  return useMutation({
+    mutationFn: (v: V) => fn(v).then(parse),
+    onSuccess: () => {
+      void qc.invalidateQueries({ queryKey: policyKeys.all });
+      void qc.invalidateQueries({ queryKey: ["subscriptions"] });
+    },
+  });
+}
+
+export const useCreatePolicy = () => useAction((body: PolicyRevisionCreate) => api.post("/policy-revisions", body));
+export const useUpdatePolicy = () =>
+  useAction(({ id, ...body }: PolicyRevisionUpdate & { id: string }) => api.patch(`/policy-revisions/${id}`, body));
+export const usePreviewPolicy = () => useAction((id: string) => api.post(`/policy-revisions/${id}/preview`));
+export const usePublishPolicy = () =>
+  useAction((v: { id: string; expectedRevision: number }) =>
+    api.post(`/policy-revisions/${v.id}/publish`, { expectedRevision: v.expectedRevision }),
+  );
+export const useRollbackPolicy = () => useAction((id: string) => api.post(`/policy-revisions/${id}/rollback`));