feat(flowctl): approval HTTP API backend (fn-20.3)

Add approval system backend: libSQL approvals table, ApprovalStore
trait + libsql impl, flowctl approval CLI (create/list/show/approve/
reject with --wait), 5 daemon REST routes, ApprovalCreated/Resolved
WS events. Replaces stdin-blocking Teams protocol.

CLI routes mutations through Unix socket at .flow/.state/flowctl.sock
when daemon is running (detected via .flow/.state/flowctl.pid),
with TCP fallback for flowctl serve --port and direct-DB writes
when the daemon is absent. This keeps the daemon as the sole
source of live approval_* events when reachable.

Integration test exercises full create → list → approve → reject
flow through the Axum router with event_bus assertions.

Task: fn-20-abf-borrowed-enhancements-archetypes.3

Author: z23cc

flowctl/Cargo.lock

@@ -36,6 +36,10 @@ regex = { workspace = true }
 sha2 = { workspace = true }
 thiserror = { workspace = true }
 which = { workspace = true }
+hyper = { version = "1", features = ["client", "http1"] }
+hyper-util = { version = "0.1", features = ["client", "client-legacy", "tokio", "http1"] }
+http-body-util = "0.1"
+bytes = "1"
 
 [dev-dependencies]
 trycmd = { workspace = true }