feat: opt-in flex-auth policy gate and OpenBao verify (WP-0007)

Add policy.py client that calls flex-auth /v1/check before sign/issue when
policy.enabled is true. Record policy_decision_id in signatures.log. Default
off preserves existing inventory-only behavior. Document production OpenBao
health probe and update config/wiki references.

tests/test_config.py

@@ -82,3 +82,35 @@ def test_default_vault_token_env(tmp_path):
     })
     cfg = load_config(cfg_path)
     assert cfg.vault.token_env == "VAULT_TOKEN"
+
+
+def test_policy_defaults_disabled(tmp_path):
+    cfg_path = tmp_path / "warden.yaml"
+    write_yaml(cfg_path, {"backend": "local", "ca_key": str(tmp_path / "ca")})
+    cfg = load_config(cfg_path)
+    assert cfg.policy.enabled is False
+    assert cfg.policy.flex_auth_url == "http://127.0.0.1:8080"
+    assert cfg.policy.fail_closed is True
+
+
+def test_policy_block_parsed(tmp_path):
+    cfg_path = tmp_path / "warden.yaml"
+    write_yaml(cfg_path, {
+        "backend": "local",
+        "ca_key": str(tmp_path / "ca"),
+        "policy": {
+            "enabled": True,
+            "flex_auth_url": "http://flex-auth:8080",
+            "fail_closed": False,
+            "tenant": "tenant:coulomb",
+            "subject_env": "MY_SUBJECT",
+            "system": "warden-test",
+        },
+    })
+    cfg = load_config(cfg_path)
+    assert cfg.policy.enabled is True
+    assert cfg.policy.flex_auth_url == "http://flex-auth:8080"
+    assert cfg.policy.fail_closed is False
+    assert cfg.policy.tenant == "tenant:coulomb"
+    assert cfg.policy.subject_env == "MY_SUBJECT"
+    assert cfg.policy.system == "warden-test"