AD-901: Add permission policy

[alph-cmky]

Summary

• Add a centralized server permission policy for read, write, safe commands, arbitrary commands, network, dependency installs, git commit, and git push.
• Default agent policy allows read and safe commands, while dangerous permissions are denied and marked as requiring approval.
• Add command evaluation that maps safe commands to safeCommands and unsafe commands to arbitraryCommands.
• Export permission policy APIs from the server package and update the AD-901 backlog checklist.

Testing

• TDD red check: pnpm test apps/server/src/security/permission-policy.test.ts initially failed because permission-policy.js did not exist.
• pnpm test apps/server/src/security/permission-policy.test.ts
• pnpm lint && pnpm format && pnpm typecheck && pnpm test && pnpm build

Stacked on #46.

Closes #22