feat: support tool-name wildcards in policies

[Zeko369]

Summary

• match policy patterns against final tool-name prefixes such as get* and delete*
• add ** for zero or more generated tool-group segments while preserving existing * behavior
• keep exact tool policies ahead of name-prefix and integration-wide policies
• document the pattern grammar and cover imported OpenAPI tool names in the self-host UI scenario

Why

Imported API descriptions commonly generate families of tool names with a shared verb prefix. Matching those names lets administrators apply one policy to every generated GET-like or DELETE-like operation without enumerating each tool.

Name-prefix matching is case-sensitive and operates on the generated tool name. OpenAPI default policy behavior continues to use the operation's actual HTTP method.

Validation

• bun run format:check
• bun run lint
• bun run typecheck
• cd packages/core/sdk && bunx vitest run src/policies.test.ts — 41 tests passed
• React test suite — 320 tests passed
• cd e2e && bunx vitest run --project selfhost scenarios/policies-ui.test.ts — passed with recording and trace

The full bun run test matrix is not currently green because of failures outside this diff: three organization-selector failures in apps/cloud/src/account/org-api-key-revoke.node.test.ts and a timeout in apps/host-selfhost/src/scope-isolation.test.ts. Both reproduce when run separately.