pub fn decision_reason_from_result(result: &Value) -> Option<String>
Extract a human-readable reason string from a denial result.