Intake API: /v1/alerts/{id} should return the policy version that produced the verdict

Summary

When the bank's systems read back an investigated alert through GET /v1/alerts/{id}, the response has the verdict, actions and report decision, but not which policy version and fingerprint produced them. Auditors need that on every decision (docs/production.md, "Decision policy").

Steps to reproduce

1. Load the example bank and post an alert (samples/example_bank).
2. GET /v1/alerts/{id} once the status is done.

Expected vs actual

Expected: the response includes policy: {label, version, fingerprint} as the console's case view does. Actual: no policy fields in the API response.

Alert / case or endpoint involved

api/app.py → GET /v1/alerts/{id}; policy summary comes from agent/policy_config.py (POLICY.summary()).