Implement managed browser security, individual agents and observability

apps/server/public/evidence-policy-admin.js

@@ -0,0 +1,16 @@
+// These controls only amend the policy draft. Normal publication/review remains authoritative.
+let evidencePolicyEditable=false;
+function updateEvidencePolicyControls(){
+  $('evidence-policy-enabled').disabled=!evidencePolicyEditable;
+  $('evidence-policy-downloads').disabled=!evidencePolicyEditable||!$('evidence-policy-enabled').checked;
+}
+function fillEvidencePolicy(p){
+  $('evidence-policy-enabled').checked=p.evidence?.enabled===true;
+  $('evidence-policy-downloads').checked=p.evidence?.captureDownloads===true;
+  updateEvidencePolicyControls();
+}
+const fillBeforeEvidencePolicy=fill;fill=function(p){fillBeforeEvidencePolicy(p);fillEvidencePolicy(p);};
+const draftBeforeEvidencePolicy=draft;draft=function(){const p=draftBeforeEvidencePolicy();p.evidence={enabled:$('evidence-policy-enabled').checked,captureDownloads:$('evidence-policy-downloads').checked};return p;};
+const permissionsBeforeEvidencePolicy=applyOperatorPermissions;applyOperatorPermissions=function(principal){permissionsBeforeEvidencePolicy(principal);evidencePolicyEditable=!!principal?.permissions?.includes(independentApprovalRequired?'policy.prepare':'policy.write');updateEvidencePolicyControls();};
+for(const id of ['evidence-policy-enabled','evidence-policy-downloads'])$(id).addEventListener('change',()=>{updateEvidencePolicyControls();updateDraftStatus();});
+if(policy)fillEvidencePolicy(policy);if(currentPrincipal)applyOperatorPermissions(currentPrincipal);