proto: add CheckPolicy RPC

CheckPolicy validates a candidate policy against a running server's
live users and nodes (running its tests block) without persisting
anything. Used by 'headscale policy check' to replace the in-process
validation path the CLI runs today, which would otherwise need its
own database connection.

Updates #1803

proto/headscale/v1/headscale.proto

@@ -204,6 +204,13 @@ service HeadscaleService {
       body : "*"
     };
   }
+
+  rpc CheckPolicy(CheckPolicyRequest) returns (CheckPolicyResponse) {
+    option (google.api.http) = {
+      post : "/api/v1/policy/check"
+      body : "*"
+    };
+  }
   // --- Policy end ---
 
   // --- Health start ---

proto/headscale/v1/policy.proto

@@ -17,3 +17,7 @@ message GetPolicyResponse {
   string policy = 1;
   google.protobuf.Timestamp updated_at = 2;
 }
+
+message CheckPolicyRequest { string policy = 1; }
+
+message CheckPolicyResponse {}