feat(approvals): gate push Approve/Deny buttons on the opt-in setting too

One switch now governs the whole feature: with approvalsInboxEnabled off
(the default), sendPushNotifications strips the actions and approvalId
from permission push payloads, so the buttons no longer render at all
(pre-inbox they rendered and did nothing). The page-side action relay is
gated the same way for stale notifications sent before the toggle
flipped. Only the store and answer endpoints keep running, so enabling
the toggle surfaces anything already pending immediately.

sendPushNotifications is async now (cached settings read); all call
sites were already fire-and-forget. Covered by three new payload tests
alongside the existing hostTitle suite.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/web/schemas.ts

@@ -791,10 +791,12 @@ export const SettingsUpdateSchema = z
      */
     agentSkillEnabled: z.boolean().optional(),
     /**
-     * Approvals Inbox UI (header bell + drawer, phone overview answer buttons).
-     * SYNCED, default OFF (opt-in): even with items pending, no surface renders
-     * until this is enabled. The server-side store and answer endpoints run
-     * regardless, so push Approve/Deny actions keep working either way.
+     * Approvals Inbox (header bell + drawer, phone overview answer buttons,
+     * push Approve/Deny action buttons). SYNCED, default OFF (opt-in): even
+     * with items pending, no surface renders and push payloads carry no
+     * actions/approvalId until this is enabled. The server-side store and the
+     * answer endpoints run regardless, so flipping it ON shows anything
+     * already pending immediately.
      */
     approvalsInboxEnabled: z.boolean().optional(),
     tunnelEnabled: z.boolean().optional(),