Improve config.toml structure for shared policy configurations (embedding, vector DB)

Current Limitation

Shared policy configurations for embedding providers, vector databases, and AI safety services are configured as flat, prefix-namespaced root-level keys in config.toml. This is
visually noisy, doesn't group related settings logically, and is inconsistent with how other policy configs (e.g., [policy_configurations.ratelimit_v010]) are structured.

Example of the current state:

azurecontentsafety_endpoint = "https://..."
azurecontentsafety_key = "..."

embedding_provider = "MISTRAL"
embedding_provider_api_key = "..."
embedding_provider_endpoint = "https://api.mistral.ai/v1/embeddings"
embedding_provider_model = "mistral-embed"
embedding_provider_dimension = 1024

vector_db_provider = "REDIS"
vector_db_provider_host = "redis-db"
vector_db_provider_port = 6379
vector_db_provider_ttl = 3600
vector_db_provider_password = "password"
vector_db_provider_username = "default"
vector_db_provider_database = "cache"

awsbedrock_guardrail_region = "us-east-1"
awsbedrock_guardrail_id = "..."
awsbedrock_secret_access_key = "..."

### Suggested Improvement

Nest these under proper TOML table sections inside [policy_configurations], consistent with the existing ratelimit and JWT auth config structure.

Proposed format:

[policy_configurations.azure_content_safety]
endpoint = "https://..."
key = "..."

[policy_configurations.embedding]
provider = "MISTRAL"
api_key = "..."
endpoint = "https://api.mistral.ai/v1/embeddings"
model = "mistral-embed"
dimension = 1024

[policy_configurations.vector_db]
provider = "REDIS"
host = "redis-db"
port = 6379
ttl = 3600
password = "password"
username = "default"
database = "cache"

[policy_configurations.aws_bedrock]
region = "us-east-1"
guardrail_id = "..."
guardrail_version = "DRAFT"
access_key_id = "..."
secret_access_key = "..."
session_token = ""
role_arn = ""
role_region = ""
role_external_id = ""


### Version

_No response_

Start with config.toml and compare the proposed policy_configurations.azure_content_safety, embedding, vector_db, and aws_bedrock tables with the existing ratelimit_v010 and JWT auth structure. Done means the shared policy settings are grouped under the proposed sections with the listed field names and no longer use the flat root-level keys.