feat(phase-2): workstream 5 — OPA Policy Engine

- policies/authz.rego: Rego policy with path normalisation and scope enforcement
- policies/data/scopes.json: all 13 endpoint → scope mappings
- src/middleware/opa.ts: OpaMiddleware with Wasm primary path + scopes.json fallback;
  exports createOpaMiddleware() and reloadOpaPolicy() for SIGHUP hot-reload
- All four route files: opaMiddleware wired after authMiddleware
- AuditController, OAuth2Service: manual scope checks removed (now centralised in OPA)
- src/server.ts: SIGHUP handler calls reloadOpaPolicy()
- docs/devops/environment-variables.md: POLICY_DIR documented
- 38 new tests; 302/302 passing; opa.ts coverage 98.66% statements

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/app.ts

@@ -33,6 +33,7 @@ import { createCredentialsRouter } from './routes/credentials.js';
 import { createAuditRouter } from './routes/audit.js';
 
 import { errorHandler } from './middleware/errorHandler.js';
+import { createOpaMiddleware } from './middleware/opa.js';
 import { createVaultClientFromEnv } from './vault/VaultClient.js';
 import { RedisClientType } from 'redis';
 
@@ -120,6 +121,11 @@ export async function createApp(): Promise<Application> {
     vaultClient,
   );
 
+  // ────────────────────────────────────────────────────────────────
+  // OPA authorization middleware (created once — shared across all routers)
+  // ────────────────────────────────────────────────────────────────
+  const opaMiddleware = await createOpaMiddleware();
+
   // ────────────────────────────────────────────────────────────────
   // Controller layer
   // ────────────────────────────────────────────────────────────────
@@ -133,13 +139,13 @@ export async function createApp(): Promise<Application> {
   // ────────────────────────────────────────────────────────────────
   const API_BASE = '/api/v1';
 
-  app.use(`${API_BASE}/agents`, createAgentsRouter(agentController));
+  app.use(`${API_BASE}/agents`, createAgentsRouter(agentController, opaMiddleware));
   app.use(
     `${API_BASE}/agents/:agentId/credentials`,
-    createCredentialsRouter(credentialController),
+    createCredentialsRouter(credentialController, opaMiddleware),
   );
-  app.use(`${API_BASE}/token`, createTokenRouter(tokenController));
-  app.use(`${API_BASE}/audit`, createAuditRouter(auditController));
+  app.use(`${API_BASE}/token`, createTokenRouter(tokenController, opaMiddleware));
+  app.use(`${API_BASE}/audit`, createAuditRouter(auditController, opaMiddleware));
 
   // ────────────────────────────────────────────────────────────────
   // Global error handler (must be last)