feat(service): PlatformGates seam + fail-closed decideOrThrow (P1.3)

LocalDevPorts = permissive in-service default (no testkit at runtime);
decideOrThrow turns OPA deny/throw/timeout into PolicyDeniedError. Tests drive
deny/timeout via testkit fakes. 12 tests green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packages/iios-service/src/app.module.ts

@@ -1,9 +1,10 @@
 import { Module } from '@nestjs/common';
 import { PrismaModule } from './prisma/prisma.module';
+import { PlatformModule } from './platform/platform.module';
 import { HealthController } from './health.controller';
 
 @Module({
-  imports: [PrismaModule],
+  imports: [PrismaModule, PlatformModule],
   controllers: [HealthController],
 })
 export class AppModule {}