feat: Approvals Inbox, one cross-session queue for prompts waiting on a human

Permission dialogs, AskUserQuestion questions and idle prompts from every
session now land in a server-side inbox (web/approval-inbox.ts, one item per
session, claude-mode only) and are answerable in place: a header bell + drawer
on desktop, inline answer strips on the phone overview's NEEDS YOU rows, and
working push Approve/Deny buttons (previously dead ends, now answered straight
from sw.js with no tab open). Pending alerts survive reloads because the
frontend seeds from GET /api/approvals on init.

Answering sends the digit / Esc / prompt text through the existing tmux input
path; option digits are accepted only when they match options parsed from the
captured pane frame, and the answer path re-captures the pane first so a
dialog that already left the screen refuses with 409 instead of typing into
the composer. New elicitation_complete / elicitation_response hook matchers
resolve question items the moment they are answered in the terminal;
refreshStaleCodemanHooks heals existing cases.

Verified end-to-end against a live claude session: a real AskUserQuestion
dialog parsed into 5 option buttons and was answered from the drawer.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/web/public/sw.js

@@ -111,14 +111,14 @@ self.addEventListener('push', (event) => {
     return;
   }
 
-  const { title, hostTitle, body, tag, sessionId, urgency, actions } = payload;
+  const { title, hostTitle, body, tag, sessionId, approvalId, urgency, actions } = payload;
 
   const options = {
     body: body || '',
     tag: tag || 'codeman-default',
     icon: '/icon-192.png',
     badge: '/icon-192.png',
-    data: { sessionId, url: sessionId ? `/?session=${sessionId}` : '/' },
+    data: { sessionId, approvalId, url: sessionId ? `/?session=${sessionId}` : '/' },
     renotify: true,
     requireInteraction: urgency === 'critical',
   };
@@ -142,24 +142,48 @@ self.addEventListener('push', (event) => {
 self.addEventListener('notificationclick', (event) => {
   event.notification.close();
 
-  const { sessionId, url } = event.notification.data || {};
+  const { sessionId, approvalId, url } = event.notification.data || {};
   const targetUrl = url || '/';
+  const action = event.action || null;
 
-  event.waitUntil(
-    self.clients.matchAll({ type: 'window', includeUncontrolled: true }).then((clients) => {
-      // Try to find an existing Codeman tab
-      for (const client of clients) {
-        if (client.url.includes(self.location.origin)) {
-          client.postMessage({
-            type: 'notification-click',
-            sessionId,
-            action: event.action || null,
-          });
-          return client.focus();
-        }
-      }
-      // No existing tab -- open a new one
-      return self.clients.openWindow(targetUrl);
-    })
-  );
+  // Approve/Deny action buttons answer the Approvals Inbox item directly from
+  // the worker, so they work with NO Codeman tab open (lock-screen approvals).
+  // Same-origin POST with cookie credentials; the CSRF Origin check passes
+  // because a service worker fetch carries the worker's own (same) origin.
+  if ((action === 'approve' || action === 'deny') && approvalId) {
+    event.waitUntil(
+      fetch(`/api/approvals/${encodeURIComponent(approvalId)}/answer`, {
+        method: 'POST',
+        credentials: 'include',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ action }),
+      }).then((res) => {
+        if (res && res.ok) return undefined;
+        // 401/404/409: let the human see the state — fall back to a tab.
+        return openOrFocus(sessionId, action, approvalId, targetUrl);
+      }).catch(() => openOrFocus(sessionId, action, approvalId, targetUrl))
+    );
+    return;
+  }
+
+  event.waitUntil(openOrFocus(sessionId, action, approvalId, targetUrl));
 });
+
+function openOrFocus(sessionId, action, approvalId, targetUrl) {
+  return self.clients.matchAll({ type: 'window', includeUncontrolled: true }).then((clients) => {
+    // Try to find an existing Codeman tab
+    for (const client of clients) {
+      if (client.url.includes(self.location.origin)) {
+        client.postMessage({
+          type: 'notification-click',
+          sessionId,
+          approvalId,
+          action,
+        });
+        return client.focus();
+      }
+    }
+    // No existing tab -- open a new one
+    return self.clients.openWindow(targetUrl);
+  });
+}