Add opt-in per-NE CLI exec_policy for MCP/API exec.

Co-authored-by: Cursor <cursoragent@cursor.com>

web/src/services/api.ts

@@ -495,6 +495,7 @@ export const fetchManagedNeMeta = () =>
     device_types: types.device_types,
     vendors: types.vendors,
     credentials_configured: creds.configured,
+    exec_policy_enabled: Boolean(types.exec_policy_enabled),
   }));
 
 export type ManagedNeStats = {