BAZ-014: add harness communication approvals

[rullopat]

Summary

• add approval-required posture to canonical Team and Group harness policy
• hold protected communication attempts durably and dispatch approved payloads at most once
• add authenticated approval API, CLI, agent status tool, Telegram integration, and responsive web queue
• complete BAZ-014 documentation and browser QA

Verification

• pnpm test (95 files, 743 tests)
• pnpm vitest run focused approval/communication/Telegram/web tests (70 tests)
• pnpm typecheck
• pnpm --filter @bazilion/web typecheck
• pnpm lint (existing warnings only)
• pnpm build
• pnpm --filter @bazilion/web build
• git diff --check
• in-app Playwright at 1440x900, 1024x768, and 390x844 in light/dark; approve/deny fixture used held Agent messages only, no model turns