fix(webui): remediate PR #856 REQUEST_CHANGES for policy visibility (#646)

Address review blockers (review #555):
- Graduate /policy nav item out of STUB_PAGES to live nav in webui/nav.py
- Update docs/webui-local-dev.md to list /policy as a live surface and remove stub copy
- Run console_redaction on HTML emit path in webui/policy_views.py before rendering HTML
- Add planted-secret HTML redaction test and nav graduation test in tests/test_webui_policy_visibility.py

tests/test_webui_policy_visibility.py

@@ -161,6 +161,19 @@ class TestPolicyRedaction(unittest.TestCase):
         self.assertNotIn("abcd1234efgh5678", blob)
         self.assertEqual(console_redaction.scan_for_secrets(payload), [])
 
+    def test_planted_secret_is_redacted_in_html_emit(self):
+        # AC2/AC3: HTML emit path runs redaction before rendering HTML cards.
+        snapshot = _snapshot([
+            _entry(
+                "redaction",
+                "redaction",
+                active={"leaked": "keychain:prgs-author-super-secret", "roles": ["author"]},
+            )
+        ])
+        html_output = render_policy_page(snapshot)
+        self.assertNotIn("keychain:prgs-author-super-secret", html_output)
+        self.assertEqual(console_redaction.scan_for_secrets(html_output), [])
+
 
 class TestPolicyRoutes(unittest.TestCase):
     def setUp(self):
@@ -201,8 +214,11 @@ class TestPolicyRoutes(unittest.TestCase):
         self.assertIn(response.status_code, (404, 405))
 
     def test_nav_links_policy(self):
+        from webui.nav import STUB_PAGES
+        self.assertNotIn("/policy", STUB_PAGES)
         text = self.client.get("/").text
-        self.assertIn('href="/policy"', text)
+        self.assertIn('href="/policy">Policy</a>', text)
+        self.assertNotIn('href="/policy">Policy</a> <span class="muted">(stub)</span>', text)
 
 
 class TestPolicyViewFailSoft(unittest.TestCase):