feat(guardrails): add pre-tool-call authorization middleware with pluggable providers (#1240)

Add GuardrailMiddleware that evaluates every tool call before execution.
Three provider options: built-in AllowlistProvider (zero deps), OAP passport
providers (open standard), or custom providers loaded by class path.

- GuardrailProvider protocol with GuardrailRequest/Decision dataclasses
- GuardrailMiddleware (AgentMiddleware, position 5 in chain)
- AllowlistProvider for simple deny/allow by tool name
- GuardrailsConfig (Pydantic singleton, loaded from config.yaml)
- 25 tests covering allow/deny, fail-closed/open, async, GraphBubbleUp
- Comprehensive docs at backend/docs/GUARDRAILS.md

Closes #1213

Co-authored-by: Willem Jiang <willem.jiang@gmail.com>

backend/packages/harness/deerflow/guardrails/builtin.py

@@ -0,0 +1,23 @@
+"""Built-in guardrail providers that ship with DeerFlow."""
+
+from deerflow.guardrails.provider import GuardrailDecision, GuardrailReason, GuardrailRequest
+
+
+class AllowlistProvider:
+    """Simple allowlist/denylist provider. No external dependencies."""
+
+    name = "allowlist"
+
+    def __init__(self, *, allowed_tools: list[str] | None = None, denied_tools: list[str] | None = None):
+        self._allowed = set(allowed_tools) if allowed_tools else None
+        self._denied = set(denied_tools) if denied_tools else set()
+
+    def evaluate(self, request: GuardrailRequest) -> GuardrailDecision:
+        if self._allowed is not None and request.tool_name not in self._allowed:
+            return GuardrailDecision(allow=False, reasons=[GuardrailReason(code="oap.tool_not_allowed", message=f"tool '{request.tool_name}' not in allowlist")])
+        if request.tool_name in self._denied:
+            return GuardrailDecision(allow=False, reasons=[GuardrailReason(code="oap.tool_not_allowed", message=f"tool '{request.tool_name}' is denied")])
+        return GuardrailDecision(allow=True, reasons=[GuardrailReason(code="oap.allowed")])
+
+    async def aevaluate(self, request: GuardrailRequest) -> GuardrailDecision:
+        return self.evaluate(request)