[codex] Add broker approval queue

[realadeel]

Summary

Turns policy prompt decisions into a real approval lifecycle in broker-dispatchd.

Prompted capability requests are now stored with a request id, exposed over D-Bus and REST, and can be approved or denied from the web UI. Approval executes the original broker action and records the decision in the audit log.

Impact

• Adds pending approval queue methods to broker-dispatchd.
• Adds approve/deny REST endpoints to ui-web.
• Adds an Approvals tab to the web UI.
• Preserves deny-by-default behavior while making user confirmation gates usable.
• Adds default prompt rules for agent filesystem writes and network egress.
• Passes prompt_message through policy evaluation for UI display.

Validation

• python -m pytest tests/ -q -> 117 passed