refactor(policy): add centralized decision helpers

lib/policy/assert.ts

@@ -0,0 +1,18 @@
+import type { Actor } from "@/lib/policy/actor"
+import type { PolicyDecision, ReasonCode } from "@/lib/policy/decision"
+
+export function allow(): PolicyDecision {
+  return { ok: true }
+}
+
+export function deny(reasonCode: ReasonCode, message?: string): PolicyDecision {
+  return { ok: false, reasonCode, message }
+}
+
+export function requireAuth(actor: Actor | null | undefined): PolicyDecision {
+  if (!actor?.userId) {
+    return deny("AUTH_REQUIRED", "请先登录")
+  }
+
+  return allow()
+}