fix: add input validation for gateway policy CRUD endpoint (#370)

[daniel007-ai]

Summary

Fixes #370 - [HIGH] No Input Validation on Gateway Policy CRUD Endpoint — Arbitrary Policy Injection

Changes

1. New file: backend/src/gateway/policyValidation.ts

   • Joi validation schema for policy CRUD payloads with strict mode (.unknown(false))
   • Prototype pollution detection via __proto__ and constructor key checks
   • ReDoS safety check for regex pattern values in rules
   • HTML/XSS sanitization for policy name and description fields

2. Updated: backend/src/gateway/PrivacyApiGateway.ts

   • Added 100KB body size limiter middleware for /gateway/policies endpoint
   • Integrated validateAndSanitizePolicy into updatePolicy method
   • Added description field to PolicyConfig interface

3. New file: backend/src/gateway/__tests__/PolicyValidation.test.ts

   • 48 comprehensive tests covering all injection vectors:
     • Prototype pollution (__proto__, constructor keys)
     • Unknown/extra fields (strict mode)
     • Missing required fields
     • Invalid rule attributes, operators, actions
     • Oversized values and excessive rules
     • XSS in name/description (HTML tags, script tags, javascript: protocol, onclick handlers)
     • ReDoS patterns (nested quantifiers, .., excessive alternation)
     • Transform rule validation
     • null/undefined/non-object payloads
     • Max rule bounds

Acceptance Criteria

• ✅ Joi schema validates all policy fields
• ✅ Rule validation (attribute, operator, value, action)
• ✅ Strict mode rejects unknown fields
• ✅ 100KB body size limit for policy endpoint
• ✅ HTML sanitization on name/description
• ✅ ReDoS safety check for regex rules
• ✅ Tests for all injection vectors
  closes [HIGH] No Input Validation on Gateway Policy CRUD Endpoint — Arbitrary Policy Injection #370