Harden public API write and compute routes

[MaxGhenis]

Summary

• require the shared expensive-endpoint guard on public policy, dynamic, aggregate, household, and agent write routes
• protect additional expensive analysis POST routes and restrict CORS to a configured allowlist
• remove anonymous database access from generated RLS policies and add security regression coverage

Testing

• uv run pytest tests/test_outputs.py tests/test_change_aggregates.py tests/test_security.py -q
• uv run ruff check src/policyengine_api/security.py src/policyengine_api/config/settings.py src/policyengine_api/main.py src/policyengine_api/api/analysis.py src/policyengine_api/api/outputs.py src/policyengine_api/api/change_aggregates.py src/policyengine_api/api/agent.py src/policyengine_api/api/policies.py src/policyengine_api/api/dynamics.py scripts/init.py tests/test_security.py