docs: document email approvals via webhook relay

[xzlknr]

Summary

• document email approvals as a webhook relay recipe instead of a native channel
• show the approve/deny callback endpoints used by the relay
• note that API secrets should stay server-side in the relay, not in email URLs

Validation

• Re-checked issue Docs: email approvals via the webhook relay #17 acceptance criteria against the final diff
• git diff --check
• pnpm exec prettier --check docs/approvals.md
• pnpm --filter @gethelio/proxy build
• pnpm --filter @gethelio/proxy exec vitest run src/approval/api.test.ts (36 passed)

Note: a full proxy test run surfaced existing Windows/local-environment failures unrelated to this docs change (dist/cli.js missing before build plus temp SQLite EBUSY cleanup), so I ran the relevant approval callback test after building the proxy.