Policies tab in local + multiplex portless across apps

[RhysSullivan]

Summary

• Port the Policies tab from apps/cloud to apps/local — new /policies route renders the shared PoliciesPage from @executor-js/react/pages/policies, and a Policies nav item was added to the local sidebar shell.
• Make all three apps (cloud, local, marketing) use the same dev:proxy + dev:vite split with portless proxy start --multiplex --port 1355, and drop the --no-tls flag from cloud's proxy script so all apps run TLS.

Test plan

• cd apps/local && bun run dev — policies tab is visible in sidebar, /policies resolves and renders the page (no 404)
• cd apps/cloud && bun run dev — proxy still starts, dev still works against TLS
• cd apps/marketing && bun run dev — proxy starts, marketing serves under multiplex
• Run two of the three apps simultaneously — both register cleanly with the shared port-1355 multiplex proxy