Admins can now manage policies
Admins can now manage policies. They can create, edit and delete them, but only within the permissions they hold themselves. A policy that a role uses, and a preset policy, stay owner-only.
Workspace admins no longer have to ask an owner for every policy change. They can create, edit and delete policies under Workspace › Policies, and a policy can never grant more than the admin holds. Owners keep two kinds of policy to themselves: one that a role uses, since changing it changes everyone with that role, and a preset policy. An admin who tries gets 403 OWNER_ROLE_REQUIRED.
Before you save or delete, the console tells you how many API keys the change reaches. The API returns the same number as bound_key_count on PATCH /v1/workspaces/:slug/policies/:id and on DELETE, which now answers 200 with { id, deleted, bound_key_count } instead of an empty 204.