feat: opt-in flex-auth policy gate and OpenBao verify (WP-0007)

Add policy.py client that calls flex-auth /v1/check before sign/issue when
policy.enabled is true. Record policy_decision_id in signatures.log. Default
off preserves existing inventory-only behavior. Document production OpenBao
health probe and update config/wiki references.

src/warden/ca.py

@@ -56,6 +56,8 @@ def _append_signature_log(
         "cert_path": str(record.cert_path),
         "backend": backend,
     }
+    if spec.policy_decision_id:
+        entry["policy_decision_id"] = spec.policy_decision_id
     state_dir.mkdir(parents=True, exist_ok=True)
     with (state_dir / "signatures.log").open("a") as f:
         f.write(json.dumps(entry) + "\n")