Implement manual role override rules in the policy engine (TODO)

[Lakes41]

Difficulty: Intermediate
Type: feature

Background
The README states role resolution in packages/policy-engine combines membership state and backend role assignments, with explicit "room for future manual override rules (TODO)".

Problem
Admins currently have no way to manually override a resolved role for a specific member (e.g., temporarily grant CONTRIBUTORS_OR_ADMINS access to a member who wouldn't otherwise qualify, or temporarily restrict a normally-eligible member), since only membership state and backend role assignments feed into resolution.

Expected outcome
packages/policy-engine supports an explicit, time-boxed manual override (grant or restrict) per member+community that takes precedence over computed roles, with overrides expiring automatically and visible in the API.

Suggested implementation

• Add a role_overrides (or similar) Prisma model: walletId, communityId, overrideRole, reason, expiresAt, createdBy.
• Extend the policy engine's role-resolution function to check for an active override first, falling back to computed roles.
• Add an admin-only route to create/revoke overrides, emitting an outbox event (e.g., ROLE_ASSIGNED/ROLE_REMOVED with an override: true flag, or a new event type).
• Add unit tests in packages/policy-engine for override precedence and expiry behavior.

Acceptance criteria

• Active overrides take precedence over computed roles
• Expired overrides no longer apply and fall back correctly
• Admin route to create/revoke overrides exists and is tested
• Policy engine unit tests (npm run -w @guildpass/policy-engine test) cover the new logic

Likely affected files/directories

• packages/policy-engine/
• apps/access-api/prisma/schema.prisma
• apps/access-api/src/routes/