feat(phase-2): workstream 5 — OPA Policy Engine

- policies/authz.rego: Rego policy with path normalisation and scope enforcement
- policies/data/scopes.json: all 13 endpoint → scope mappings
- src/middleware/opa.ts: OpaMiddleware with Wasm primary path + scopes.json fallback;
  exports createOpaMiddleware() and reloadOpaPolicy() for SIGHUP hot-reload
- All four route files: opaMiddleware wired after authMiddleware
- AuditController, OAuth2Service: manual scope checks removed (now centralised in OPA)
- src/server.ts: SIGHUP handler calls reloadOpaPolicy()
- docs/devops/environment-variables.md: POLICY_DIR documented
- 38 new tests; 302/302 passing; opa.ts coverage 98.66% statements

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/server.ts

@@ -7,6 +7,7 @@ import * as dotenv from 'dotenv';
 dotenv.config();
 
 import { createApp } from './app.js';
+import { reloadOpaPolicy } from './middleware/opa.js';
 
 const PORT = parseInt(process.env['PORT'] ?? '3000', 10);
 
@@ -37,6 +38,14 @@ async function main(): Promise<void> {
     process.on('SIGINT', () => {
       shutdown();
     });
+
+    // Hot-reload OPA policy without restarting the server
+    process.on('SIGHUP', () => {
+      reloadOpaPolicy().catch((err) => {
+        // eslint-disable-next-line no-console
+        console.error('[AgentIdP] Failed to reload OPA policy:', err);
+      });
+    });
   } catch (err) {
     // eslint-disable-next-line no-console
     console.error('Failed to start server:', err);