[Epic] WAF: rules, compliance, and observability

Harper's web application firewall: the middleware, its rule surface, and what it must do to be usable as an assessed control.

## Scope

**In:** WAF middleware and rule evaluation, audit logging and redaction of what it blocks, rule-change trails, monitor mode, health signal, and the starter rule pack.

**Out:** general HTTP security headers (#1660) and authentication/authorization enforcement (#1646). The WAF sits in front of those, but a defect in either is theirs.

## Why

Spans both repos — the middleware is in `harper`, the compliance definition-of-done in `harper-pro` — which is exactly the kind of work that goes untracked when it has no parent.

_Created during backlog triage. Child issues keep their own priorities and milestones._

Start by locating the WAF middleware and rule-evaluation entry points in harper, then read the compliance definition of done in harper-pro. Map the stated scope across both repositories, including audit logging, redaction, rule-change trails, monitor mode, health signals, and the starter rule pack; done means the epic's child issues cover these requirements without overlapping #1660 or #1646.

Written by the indexing model from the issue text.