Add API_POLICIES.md (closes #137)

prompts/API_POLICIES.md states sneak's rule from
sneak/routewatch#199: a value in an API
response is never a string with a label or unit in it. A native value
is sent as that type, with its unit in the field name.

The list at the top of REPO_POLICIES.md and the two code style
commands in the README now name the new file.

Model: opus-5-5

TODO.md

@@ -21,6 +21,11 @@ fmt-check, and commit.
 
 # Completed Steps
 
+- 2026-10-27: Added `prompts/API_POLICIES.md`
+  (https://git.eeqj.de/sneak/prompts/issues/137). It holds sneak's rule from
+  https://git.eeqj.de/sneak/routewatch/issues/199 that a value in an API
+  response is never a string with a label or unit in it. `REPO_POLICIES.md` and
+  the code style commands in the README name the new file.
 - 2026-10-21: Check builds may now also keep the Python packages a `test` phase
   installs from `Pipfile.lock` (issue 133), on sneak's ruling in
   https://git.eeqj.de/sneak/rfscan/issues/80#issuecomment-153437. The install