feat: draft, publish and roll back auth policy changes #402

Why

Policy changes take effect immediately today. Self-hosters cite this as how Keycloak deployments lock out every user.

What

• Policy-affecting system config changes can be saved as a draft
• Publish applies them atomically; every published version is kept
• Roll back to any previous version in one step
• Audit each step

Done when

A policy change can be reviewed before it applies and undone in one step.