Don't swallow JSON encoding and policy rollback errors

[haasonsaas]

Problem

Several error returns are silently discarded in non-cleanup code paths:

1. `internal/controlplane/server.go:282` — `_ = json.NewEncoder(w).Encode(v)` swallows JSON serialization errors. If encoding fails, the client gets a partial/empty response with a 200 status.

2. `internal/controlplane/grpc.go:403` — `_ = s.server.store.DeletePolicy(ctx, policy.ID)` ignores deletion failures during a policy sync rollback. If the rollback fails, the system is in an inconsistent state with no signal.

Fix

1. For JSON encoding: check the error and log it (response is already partially written, so can't change status code, but should log)
2. For policy deletion rollback: log the error at `error` level with the policy ID so operators can investigate

Acceptance Criteria

• JSON encoding errors are logged
• Policy rollback failures are logged with context
• No silent error swallowing in non-cleanup paths

[haasonsaas]

Resolved on main: writeJSON now logs JSON encoding failures and policy assignment rollback logs deletion failures with the policy ID. Closing as fixed.