fix(approvals): stop fire-and-forget notify() piling up in "needs you"

[clawedassistant26]

The bug

notify() is fire-and-forget. src/commands.mjs says so, and it never calls pollApproval — it posts, prints the link, and returns. Only ask() blocks on a human.

POST /api/approvals filed both kinds as status = 'pending'. So every notification a script fires parks itself in the dashboard's "needs you" queue and stays there for good.

Repro (executed on unmodified main, real routers + real libsql)

A normal script run: three notify() calls for progress, one ask() for the real gate.

notify("build started")     -> 201, status: pending
notify("tests green")       -> 201, status: pending
notify("deployed to prod")  -> 201, status: pending
ask("promote to stable?")   -> 201, status: pending

GET /dashboard
  banner            : 4 waiting on you
  'Needs you' shows : promote to stable?, deployed to prod, tests green, build started
  'Moshed' history  : (empty)

Exactly one thing is waiting on the operator. The dashboard says four.

It doesn't self-clear either. The only way to get a notification out of the queue is to open it and click Approve & continue (sending a reply to a script that stopped listening) or Kill the loop (killing nothing). A chatty script buries the one ask() that actually needs a human — which is the whole point of the surface.

The fix

apps/pwa/src/routes/approvals.mjs only. A notify is done the moment it goes out, so ingest files it as sent with submitted_at set, and it lands in "moshed" history instead of the queue.

• ask() is untouched — still pending, still submitted_at = null, still polled by the CLI the same way.
• resolve() already no-ops on anything but pending, so a notify can't be flipped by the approve form. The approve page now says "This was a notification — nothing to respond to." instead of rendering an empty You replied: "".
• The dashboard split (status = 'pending' / status != 'pending') and pollApproval (which only reacts to submitted / killed) both handle the new value with no change. No migration needed — status is a plain TEXT column and existing rows are untouched.
• One comment change in 001_init.sql to keep the documented status vocabulary accurate. Migrations are tracked by filename, so applied databases are unaffected.

Tests

New apps/pwa/test/approvals-notify.test.mjs, 5 tests, with the same skip-guard the other PWA tests use when the app's deps aren't installed.

Stash-verified with git stash push -q -- apps/pwa/src/: 4 of 5 fail unpatched, 5/5 with the fix. The fifth ("an ask() still waits on a human") passes either way on purpose — it's there to lock in that this change doesn't touch the blocking path.

Full root suite npm test: 197 tests / 197 pass / 0 fail (baseline on main measured this run: 192 / 192 / 0).