A dedicated backend service for AI policy generation

The AI policy generator is now powered by a dedicated backend service running alongside the main admin application. Keeping the AI pipeline in its own process means a long policy generation cannot block the admin app, and we can scale the two services independently as demand changes.

The service is provider-agnostic. The same code path generates a draft whether you picked one provider or another — adapter modules per provider handle the translation. That means adding a new LLM in the future is a small change, not a structural rewrite.

Operationally the service exposes a readiness probe, structured logs, and metric counters per provider so we can spot quota issues and latency outliers before customers do.