Resolve the access rule that governs a cipher for a caller: load the rules on
every collection through which the caller reaches the cipher, pick the oldest
(earliest creation date, ties broken on id) so selection is deterministic and
structural, then evaluate that rule's conditions through the engine to report
whether it requires human approval. Malformed stored conditions fail safe to
human approval so access never silently auto-approves. Registered scoped; the
resolver is the shared entry point the access-request and lease flows build on.

…onverter

Close the coverage gaps in the PAM engine slice:
- Engine: malformed-but-present CIDR and time-window bounds (fail closed), and
  matching on a later CIDR/window entry rather than only the first.
- Resolver: a governing rule that no longer loads is skipped, both when it is
  the only candidate (no governance) and when a surviving newer rule takes over;
  and a time_of_day condition is parsed and evaluated through the resolver.
- Port AccessWeekdayJsonConverterTests (source was already on the branch,
  untested), including the AccessWeekday/DayOfWeek numeric-alignment guard.

Move per-condition evaluation onto each AccessCondition via an abstract
Evaluate(AccessSignals). The engine is now only the combiner: it folds the
per-condition results (deny > approval > allow, empty allows, null entry fails
closed) and no longer knows how any kind decides.

Validate conditions through an exhaustive IAccessConditionVisitor rather than a
type switch, so adding a kind fails to compile until validation handles it.
UnsupportedCondition consequently only guards a null entry now — an unknown kind
is rejected at the JSON layer and can't reach evaluation.

Also document each condition's JSON wire format.

Move each condition's evaluation branches out of AccessRuleEngineTests into
IpAllowlistConditionTests and TimeOfDayConditionTests, and test the combination
semantics directly on AccessEvaluation.Combine. AccessRuleEngineTests keeps only
the engine's orchestration (delegation, folding, signal forwarding, empty list,
null-entry fail-closed), exercised with a stub condition.

Also add direct TimeWindow.Contains coverage for the inclusive boundaries
(time == from/to) and unparseable bounds, which the engine tests never hit.

AccessRule.Enabled was never checked, so a disabled rule still governed its
collections. Because selection is oldest-wins and structural, a disabled but
permissive rule (e.g. empty conditions, which auto-grant) could shadow a newer
enabled restrictive rule and silently grant access the active rule would have
gated.

Drop rules with Enabled == false from the candidate set, alongside the existing
deleted-rule skip, so a disabled rule stops governing entirely. Pin Enabled in
the resolver test fixtures so a governing rule is deterministically enabled
(AutoFixture's bool sequence could otherwise disable it), and add coverage for a
disabled sole rule (ungoverned) and a disabled oldest rule (newer enabled rule
governs).

Give each AccessCondition a Validate() alongside Evaluate() and remove the
IAccessConditionVisitor. AccessRuleValidator now delegates per-condition checks
to condition.Validate() and only enforces the document-level shape (array, size
limit, null-entry guard). TimeWindow gains its own Validate() plus a shared
TryParseTime, so Contains and validation use one HH:mm parse rather than a regex
that could drift from evaluation.

AccessRuleValidationResult moves into the conditions namespace so the condition
models do not depend on the service layer.

Now that each condition validates itself, move the per-kind validation
assertions to the condition tests: IpAllowlistConditionTests (empty/invalid
CIDR), TimeOfDayConditionTests (missing/unknown tz, no windows), and
TimeWindowTests (no days, malformed HH:mm bounds).

Trim AccessRuleValidatorTests to the validator's remaining job — JSON
parse/shape/size, null entry, and delegation — keeping the unknown-weekday-token
case as a deserialization concern. Mirrors the earlier relocation of the
evaluation tests onto the conditions.