feat: `vouch approve --batch` for scriptable bulk approval

[plind-junior]

What you're trying to do

Approving a review queue is one vouch approve <id> per proposal. For CI /
automation (and clearing a backlog) I want to approve a known set in one call.

This complements the interactive vouch review (#83) — that's a human walking
the queue; this is non-interactive and scriptable.

Acceptance

• vouch approve <id1> <id2> … (or --batch) approves multiple proposals.
• One audit event per approved artifact.
• Clear all-or-nothing vs best-effort semantics (documented).