P0: approve/reject node actions are GET — email prefetch can auto-approve a destructive action

[hellodk]

Part of #639. Verified. node_actions.py:541/597 — approve_action and reject_action are @actions_router.get. GET mutating state is CSRF/prefetch-unsafe: mail clients (Gmail/Outlook/iOS) and link-unfurlers prefetch URLs in HTML email → silently approve/reject before the operator reads it. Token entropy is irrelevant to GET-prefetch.

AC

• approve/reject become POST; the emailed link opens a GET confirmation page that submits a POST.
• Combine with the approve() TOCTOU fix (SELECT FOR UPDATE / atomic CAS) so concurrent approves can't double-dispatch.

Tests

• approve via GET → 405; via POST → works; second concurrent POST → no double dispatch.

[hellodk]

Reframed by the agentic design decision (2026-06-09): approvals move to the in-kri admin Approvals Inbox (POST, admin-gated, full context) and the email becomes notify-only (a link to the inbox, not a state-mutating GET). That design retires this GET-prefetch CSRF risk. This ticket is folded into the agentic-assistant epic (Phase B — the approval inbox). Keeping it open as the tracking reference until the inbox lands; the minimal interim mitigation (require POST/confirm on the email link) can be done first if we want it before Phase B.