Surface failed policy and OAuth app mutations

[morluto]

Fixes #1412

Summary

Policy writes and OAuth app removal used effect-atom's promise mode, which rejects when a mutation returns a failed Exit. Their UI callers discarded those rejected promises, leaving users without failure feedback.

This change uses promiseExit and handles failed Exits explicitly in both workflows.

Changes

• Show mutation error toasts for policy create, update, and remove failures.
• Record a newly created policy ID only after creation succeeds.
• Remove created-policy ID bookkeeping only after removal succeeds.
• Keep the OAuth removal confirmation dialog open when removal fails.
• Run OAuth removal analytics, success notification, dialog cleanup, and selected-app cleanup only after confirmed success.
• Add browser regression coverage for rejected policy creation, rejected policy removal, and rejected OAuth app removal.
• Add a patch changeset for the user-visible correction.

Successful mutation behavior, optimistic rollback behavior, API contracts, and persistence contracts remain unchanged.

Regression proof

The browser tests were applied to a detached checkout of origin/main without the implementation changes:

cd e2e
../node_modules/.bin/vitest run --project selfhost scenarios/policies-ui.test.ts selfhost/oauth-app-modal.test.ts

Before the fix, both tests timed out waiting for their expected failure messages. After the fix, both tests passed.

The policy scenario also verifies that rejected policy removal keeps the policy blocked and persisted. The OAuth scenario verifies that the registered app and confirmation dialog remain present after rejection.

Review the rejected policy create and remove steps in this recording:

Review the rejected OAuth app removal step and retained confirmation dialog in this recording:

Validation

• bun run bootstrap
• cd packages/react && bun run test: 32 files and 229 tests passed.
• cd packages/react && bun run typecheck
• cd e2e && bun run typecheck
• Focused selfhost browser run: 2 files and 2 tests passed.
• bun run lint: 0 warnings and 0 errors.
• bun run format
• git diff --check
• Branch autoreview against origin/main returned no actionable findings.

Review order

1. Browser regression assertions in the policy and OAuth scenarios.
2. Policy Exit handling and success-only ID bookkeeping.
3. OAuth removal Exit handling and dialog state.
4. Patch changeset.