View a policy version's content, and make policy text readable

The Policies admin page listed versions but never showed what any of them
said, so revising a policy meant retyping it blind into an empty draft box.
Each version row now has a View action that renders that version's text on
the page, editable in place. A draft is saved back to itself; editing a
published or archived version branches a new draft and leaves the original
alone, because acceptances are recorded against policy_version_id and text a
student agreed to must stay exactly as they saw it.

That viewer also exposed why a studio reported the acceptance box as
unreadable — one squashed line, overlapping words, a horizontal scrollbar.
Bodies are typed into a bare textarea, so most carry no markup, and the raw
text was emitted with its blank lines intact but nothing to turn them into
paragraphs. PolicyVersion::bodyHtml() now renders every body the way
WordPress renders post content (kses, then wpautop) and feeds all three
consumers: the booking/enrolment JSON, the signup form, and the new viewer.
Bodies written with markup are unaffected.

The other half was that .us-policy-body had no CSS whatsoever and inherited
whatever the theme did with an unstyled block in a form. It is now a bounded
reading box that scrolls vertically and breaks long tokens, so a pasted URL
cannot force the page sideways and a long policy cannot push the accept
checkbox out of view. RegistrationPage was also never enqueueing the plugin
stylesheet, which is why the signup gate looked worst of all.

Closes #126
Closes #127

Co-Authored-By: Claude Opus 5 <[email protected]>

src/Policy/PolicyEndpoint.php

@@ -104,9 +104,9 @@ class PolicyEndpoint {
 				'policy_version_id' => $version->id,
 				'version_number'    => $version->versionNumber,
 				// Bodies are kses'd on every write path, but the booking JS renders
-				// this HTML raw — sanitise at output too so a missed write path can
-				// never become stored XSS.
-				'body'              => wp_kses_post( (string) $version->body ),
+				// this HTML raw — bodyHtml() sanitises at output too, so a missed
+				// write path can never become stored XSS.
+				'body'              => $version->bodyHtml(),
 			];
 		}