feat(CNAP-424): approval-required policy action with actionable fail-fast errors

[robinbraemer]

Summary

• Adds approval as a policy action alongside allow and deny
• Implements ApprovalRequiredError with actionable error messages (includes rule message, approval URL, retry instructions)
• Implements ApprovalStore for in-memory approval state tracking with TTL support
• Adds REST endpoints: GET /v1/approvals, POST /v1/approvals/:id/approve, POST /v1/approvals/:id/deny
• Approved requests pass through on retry (with configurable TTL, default 1h)
• PolicyEngine evaluates rules in order — first match wins, default is allow

Test plan

• Unit tests: approval policy evaluation, error formatting, state tracking
• Integration test: request → approval required → approve → retry succeeds