Resource is accepted instead of failing validation

fhir-candle version: 0.2026.528.2036

# Steps to Reproduce
- Start the FHIR Candle server:
`fhir-candle -o`

- Send a POST request to `http://localhost:5826/fhir/r4b/Consent` with the following body:
```json
{
"resourceType": "Consent",
"status": "active",
"scope": {
"coding": [
{
"system": "http://terminology.hl7.org/CodeSystem/consentscope",
"code": "adr"
}
]
},
"category": [
{
"coding": [
{
"system": "http://terminology.hl7.org/CodeSystem/consentcategorycodes",
"code": "acd"
}
]
}
]
}
```

# Expected Behavior
The server should reject the request with the validation error: **`ppc-1: Either a Policy or PolicyRule must be provided.`**

This constraint is defined in the FHIR Consent specification:
https://hl7.org/fhir/R4B/consent.html#invs

# Actual Behavior
The server returns **HTTP 201 Created** instead of rejecting the request.