feat: Approvals Inbox, one cross-session queue for prompts waiting on a human

Permission dialogs, AskUserQuestion questions and idle prompts from every
session now land in a server-side inbox (web/approval-inbox.ts, one item per
session, claude-mode only) and are answerable in place: a header bell + drawer
on desktop, inline answer strips on the phone overview's NEEDS YOU rows, and
working push Approve/Deny buttons (previously dead ends, now answered straight
from sw.js with no tab open). Pending alerts survive reloads because the
frontend seeds from GET /api/approvals on init.

Answering sends the digit / Esc / prompt text through the existing tmux input
path; option digits are accepted only when they match options parsed from the
captured pane frame, and the answer path re-captures the pane first so a
dialog that already left the screen refuses with 409 instead of typing into
the composer. New elicitation_complete / elicitation_response hook matchers
resolve question items the moment they are answered in the terminal;
refreshStaleCodemanHooks heals existing cases.

Verified end-to-end against a live claude session: a real AskUserQuestion
dialog parsed into 5 option buttons and was answered from the drawer.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/web/public/mobile-overview.js

@@ -639,9 +639,58 @@ Object.assign(CodemanApp.prototype, {
     chevron.textContent = '›';
     item.appendChild(chevron);
 
+    // Approvals Inbox: a pending dialog for this session gets an answer strip
+    // BELOW the row (the row itself is a <button>, so actions cannot nest
+    // inside it). Tapping the row still opens the session, unchanged.
+    const approval = this._pendingApprovalForSession(row.id);
+    if (approval) {
+      const wrap = document.createElement('div');
+      wrap.className = 'mobile-overview-row-wrap';
+      wrap.appendChild(item);
+      wrap.appendChild(this._buildMobileOverviewApprovalStrip(approval));
+      return wrap;
+    }
+
     return item;
   },
 
+  /** The session's pending approval, when the strip should render (dialogs only). */
+  _pendingApprovalForSession(sessionId) {
+    if (!this.approvals || !this.approvalsInboxEnabled || !this.approvalsInboxEnabled()) return null;
+    for (const item of this.approvals.values()) {
+      if (item.sessionId === sessionId && item.kind !== 'idle') return item;
+    }
+    return null;
+  },
+
+  /** Compact answer buttons for a NEEDS YOU row: parsed options, else Approve/Deny. */
+  _buildMobileOverviewApprovalStrip(approval) {
+    const strip = document.createElement('div');
+    strip.className = 'mobile-overview-approval-strip';
+    strip.setAttribute('data-i18n-skip', '');
+    const addBtn = (label, cls, onTap) => {
+      const btn = document.createElement('button');
+      btn.type = 'button';
+      btn.className = 'mobile-overview-approval-btn' + (cls ? ' ' + cls : '');
+      btn.textContent = label;
+      btn.addEventListener('click', (ev) => {
+        ev.stopPropagation();
+        onTap();
+      });
+      strip.appendChild(btn);
+    };
+    if (approval.options && approval.options.length) {
+      for (const o of approval.options) {
+        const label = o.label.length > 24 ? o.label.slice(0, 24) + '…' : o.label;
+        addBtn(`${o.n}. ${label}`, o.n === 1 ? 'primary' : '', () => this.answerApproval(approval.id, 'option', o.n));
+      }
+    } else {
+      addBtn('Approve', 'primary', () => this.answerApproval(approval.id, 'approve'));
+      addBtn('Deny', 'danger', () => this.answerApproval(approval.id, 'deny'));
+    }
+    return strip;
+  },
+
   /** A past conversation. Tapping it resumes, which creates a fresh session. */
   _buildMobileOverviewPastRow(row) {
     const item = document.createElement('button');