fix(ui): gated toggle reads addon-config flag, not Policy.enabled (#966)

The per-tool 'security gated' toggle was grayed out even when the user
had enable_tool_security_policies turned ON in the addon config + the
Server Settings tab toggle, because the JS was reading Policy.enabled
(the file field) instead of the addon-config feature flag — which is
the single source of truth for whether the middleware is active.

loadPolicyState now reads enable_tool_security_policies from
/api/settings/features (same place renderFeatureFlags consumes from).

Author: kingpanther13

src/ha_mcp/settings_ui.py

@@ -956,19 +956,34 @@ def apply_tool_visibility(
 };
 
 async function loadPolicyState() {
+  // policyState.enabled mirrors the addon-config flag
+  // (enable_tool_security_policies) — the single source of truth for
+  // whether the middleware is active. Read it from /api/settings/features
+  // (where it appears via FEATURE_FLAG_FIELDS) rather than Policy.enabled
+  // in tool_policy.json, which has no UI surface and would always look
+  // false even when the addon-config flag is on.
+  try {
+    const fresp = await fetch('./api/settings/features');
+    if (fresp.ok) {
+      const fdata = await fresp.json();
+      const flag = (fdata.flags || {})['enable_tool_security_policies'];
+      policyState.enabled = !!(flag && flag.value);
+    } else {
+      policyState.enabled = false;
+    }
+  } catch (_e) {
+    policyState.enabled = false;
+  }
   try {
     const r = await fetch('./api/policy/config');
     if (!r.ok) {
-      policyState.enabled = false;
       policyState.gatedTools = new Set();
       return;
     }
     const p = await r.json();
-    policyState.enabled = !!p.enabled;
     policyState.gatedTools = new Set((p.rules || []).map(rule => rule.tool_name));
   } catch (_e) {
     // Policy endpoint unavailable (sidecar stub) — leave gatedTools empty.
-    policyState.enabled = false;
     policyState.gatedTools = new Set();
   }
 }