feat(mcp): add the Approvals page for MCP step-up requests #125

Summary

Add an Approvals page to the Fleet Manager web UI for MCP step-up requests (parent: CryptOS-PKI/cryptos-manager#103, phase 2). An agent's step-up tool call creates a pending approval, which a person approves or denies here while presenting an operator certificate. The agent only holds a bearer key, and the web UI never accepts it.

• The page lists approvals via ListApprovals, filtering on pending by default and switchable to all. Columns: tool, summary, requested by (CN), key, required level, created, expires, and status.
• Approve and Deny call DecideApproval. Each needs a confirmation that repeats the summary and the request digest. The buttons are disabled when the operator's level is below required_level, or when the approval isn't pending.
• A navigation entry sits next to Agent keys, with a count badge for pending approvals.

Acceptance criteria

• Component tests come first, for list, filter, approve, deny and the level gating.
• Lint, typecheck, tests and build pass.
• README is updated.