[gateway] Wire OPA policy checks before upstream model calls

[kaynor]

Goal

Call OPA from the gateway on each chat completion and enforce allow/deny.

Acceptance criteria

• Gateway loads agent policy context from registry
• OPA query uses policies/opa/agentvoir.rego
• Denied requests return 403 with structured error
• Usage events record policy denials

Suggested files

• apps/gateway/internal/gateway/handler.go
• policies/opa/