[Bugs5382]

What and why

Adds a page for the web UI's new Approvals page (CryptOS-PKI/cryptos-web#126): the step-up approvals the Fleet Manager raises before an MCP tool that changes the fleet runs, and how a person decides them. The page is one task under Fleet Manager, next to The web UI.

• What a step-up approval is: what the agent gets back (approval ID, summary, approve link, expiry), and that only a browser with an operator certificate can decide one.
• Opening a request: the ?id= link from the agent's approve_url, the pending badge, the status filter and the columns.
• Approving and denying: the confirmation with the summary and request digest, the expected result, and the inline refusal. A danger callout sits before the step.
• Who can decide: the level gating in the page and in the manager, and the live level check on the agent's second call.
• Expiry and single use: the 15-minute window (caution callout), one call per approval, same key, tool and arguments, and the audit trail.
• The web UI page's nav list and its Agent keys section link to the new page, and the sidebar lists it.

There are no commands on the page, so it has no OS tabs. Examples use fleetos.example.org.

Refs CryptOS-PKI/cryptos-web#125

Merge order: merge together with CryptOS-PKI/cryptos-web#126. The manager side is already on manager main.

Verification

• Build succeeds
• Documentation updated (if behavior or API changed)

How this was verified

• npm ci --ignore-scripts && npm run build: the site builds with no broken links or warnings.
• Checked against manager main (docs/mcp.md, internal/approval, the store's decide and use checks) and the web#126 page and dialog, for the 15-minute expiry, the single use, the level rules, the refusals and the labels quoted.

---

Before merging: add a closing comment summarizing what was actually done in this PR
(not just the checked boxes).

[Bugs5382]

Closing summary: adds the Approving agent requests page (what a step-up approval is, opening it from the agent's link, approve and deny, who can decide, 15-minute expiry and single use), linked from the sidebar and the web UI page. Companion to CryptOS-PKI/cryptos-web#126.