CRITICAL: HERALD approval endpoints have NO authentication

[rz1989s]

File: packages/agent/src/routes/herald-api.ts + index.ts

heraldRouter mounted without verifyJwt. Anyone can approve/reject tweets via POST /api/herald/approve/:id, view DMs and budget data.

Fix: Add verifyJwt + admin role check.

Ref: PR #70 audit