Gets one periodic sync policy by id.

There is at most one policy per `(provider, integrationConfigId)` — the config a sync sweeps is the policy's identity — so saving twice for the same config replaces the policy rather than adding a rival one. The whole policy is sent each time: the enrollment half has to be stateable as "off", and re-confirming it on every save is the right amount of friction for the field that decides whether a timer grants people access to an application. The cadence is an interval measured from the last enqueue, bounded to between 15 minutes and 90 days. A freshly saved policy waits one full interval before its first run, so saving is never a way to start a sweep — use `POST directory/import` for that. Re-saving keeps the existing clock, so widening a cadence neither double-fires nor skips a cycle. Omitting `targetNetworkId` — the default — makes the periodic run Directory-only: contacts are created and refreshed, and nobody is granted access. Enrollment on a timer is deliberately an explicit choice, because the compensating control for a bulk sweep skipping the per-contact approve gate is an operator reading the dry-run report, and an unattended run has no one reading it. With a target set, `agentMode=OFF_HUMAN_ONLY` stages new contacts (grant created, agent silent) instead of putting the agent live for everyone the sweep finds.