fn parse_rule(item: &Value) -> Result<MaskRule, String>
Parses and validates one rule object, compiling regexes and dotted paths.