feat: Add bundles and allow for basic FastAPI session interaction

[SkPhilipp]

Closes #4

This adds "bundles", bundles group policies together which clients can opt in to.

Universal policies (those with no bundles) always run. The client also includes a new option, --bundle which makes the client request the activation of those policies.

For example you might have a project in which you use uv and instead of interacting with pip or python:

agent-policies/src/devleaps/policies/example/main.py

Lines 48 to 68 in 6e7c071

	def uv_bundle_rule(input_data: ToolUseEvent):
	if not input_data.tool_is_bash:
	return
	command = input_data.command.strip()
	# Block pip commands, suggest uv
	if re.match(r'^pip(?:\s|$)', command):
	yield PolicyDecision(action=PolicyAction.DENY, reason="Use `uv` instead of pip for package management.")
	yield PolicyGuidance(content="Replace `pip install` with `uv pip install` or `uv add` for dependency management.")
	return
	# Block python -m pip, suggest uv
	if re.match(r'^python3?\s+-m\s+pip(?:\s|$)', command):
	yield PolicyDecision(action=PolicyAction.DENY, reason="Use `uv` instead of python -m pip.")
	return
	# Block direct python usage for scripts, suggest uv run
	if re.match(r'^python3?\s+[^-]', command) and not re.match(r'^python3?\s+.*test', command):
	yield PolicyDecision(action=PolicyAction.DENY, reason="Use `uv run python` to execute scripts.")
	return

But not all your projects might be using uv, which would make this policy complicated for regular Python projects. With the new feature, you can put the uv policies under a bundle, like so:

agent-policies/src/devleaps/policies/example/main.py

Line 78 in 6e7c071

registry.register_handler(ToolUseEvent, uv_bundle_rule, bundle="uv")

And run the client with --bundle uv to enable that rule. You can add as many rules and middleware as you like on one bundle.

---

In addition, this PR adds a small wrapper around FastAPI's session mechanism. Events from Claude Code and Cursor both have a session-id, this is used more or less as a session cookie. That way, you can make policies that enable only when certain actions have or have not occurred for earlier steps. As a simple example, one could make a policy that disallows git commit without first running tests.