feat(service): PlatformGates seam + fail-closed decideOrThrow (P1.3)

LocalDevPorts = permissive in-service default (no testkit at runtime);
decideOrThrow turns OPA deny/throw/timeout into PolicyDeniedError. Tests drive
deny/timeout via testkit fakes. 12 tests green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packages/iios-service/src/platform/platform.module.ts

@@ -0,0 +1,10 @@
+import { Global, Module } from '@nestjs/common';
+import { PLATFORM_PORTS, LocalDevPorts } from './platform-ports';
+
+/** Binds the platform ports (P1: the permissive in-service default). */
+@Global()
+@Module({
+  providers: [{ provide: PLATFORM_PORTS, useClass: LocalDevPorts }],
+  exports: [PLATFORM_PORTS],
+})
+export class PlatformModule {}