fix(config): include media-auth policies in the config-YAML round-trip

[ntt0601zcoder]

Problem

The unified /config/yaml bundle (what the console's YAML editor reads/writes) only carried global_config / templates / streams / hooks / vod — it never included the new media-auth Policy entities. So:

• Policies didn't appear in the YAML view at all.
• A YAML backup/restore silently dropped every policy.
• A PUT /config/yaml containing a policies: key was rejected (INVALID_YAML, strict KnownFields decode).

Policies were only reachable via the /policies REST API (the Auth tab).

Fix

• fullConfig gains a policies section; GetConfigYAML lists + emits it.
• ReplaceConfigYAML applies policies (validate → upsert → ref-checked delete) before templates and streams (both reference a policy via playback_policy), then hot-reloads the authorizer so the change takes effect with no restart.
• A policy still referenced by a desired stream or template cannot be deleted (mirrors the template ref-check).
• ConfigHandler gains the policy repo + SetAuthorizer (wired in wireMediaAuth alongside the policy handler).

Tests

• GET bundles policies; PUT applies + hot-reloads; invalid policy (require_token w/o secret) → 422; deleting a referenced policy is refused.
• go build, go vet, golangci-lint (0 issues), go test -race ./... all green.