feat(phase-2): workstream 5 — OPA Policy Engine

- policies/authz.rego: Rego policy with path normalisation and scope enforcement
- policies/data/scopes.json: all 13 endpoint → scope mappings
- src/middleware/opa.ts: OpaMiddleware with Wasm primary path + scopes.json fallback;
  exports createOpaMiddleware() and reloadOpaPolicy() for SIGHUP hot-reload
- All four route files: opaMiddleware wired after authMiddleware
- AuditController, OAuth2Service: manual scope checks removed (now centralised in OPA)
- src/server.ts: SIGHUP handler calls reloadOpaPolicy()
- docs/devops/environment-variables.md: POLICY_DIR documented
- 38 new tests; 302/302 passing; opa.ts coverage 98.66% statements

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/unit/repositories/CredentialRepository.test.ts

@@ -38,6 +38,7 @@ const EXPECTED_CREDENTIAL: ICredential = {
 const EXPECTED_CREDENTIAL_ROW: ICredentialRow = {
   ...EXPECTED_CREDENTIAL,
   secretHash: CREDENTIAL_ROW.secret_hash,
+  vaultPath: null,
 };
 
 // ─── suite ───────────────────────────────────────────────────────────────────