feat: api for plan validation rules and result reads

[adityachoudhari26]

Sub-issue of #1073.

Policy CRUD

Add planValidation as a new rule type in the existing policy rules array. No new path — uses the existing policy endpoints.

{
  "rules": [
    {
      "planValidation": {
        "name": "require-resource-limits",
        "rego": "package ...\nimport rego.v1\n...",
        "severity": "error"
      }
    }
  ]
}

• apps/api/src/routes/v1/workspaces/policies.ts — extend insertPolicyRules and formatPolicy to handle the new rule type alongside the existing ten.
• apps/api/openapi/schemas/policies.jsonnet (and refs under schemas/) — add the rule schema.

Validation results read

GET /v1/workspaces/{workspaceId}/deployments/{deploymentId}/plan/{planId}/targets/{targetId}/validations

Returns the stored deploymentPlanTargetResultValidation rows for the target, joined with rule name/severity.

• apps/api/src/routes/v1/workspaces/deployments.ts — handler.
• apps/api/openapi/paths/deployments.jsonnet — path entry alongside the existing plan endpoints (line ~91).
• apps/api/openapi/schemas/deployments.jsonnet — PlanTargetValidationResult schema.

Depends on

Schema sub-issue.