feat: derive approval reasons at read time and add opt-in auto-approve rules

[lr00rl]

What

From the 2026-08-10 review: 45 pending production approvals, every reason empty, and trusted system writers force a human click for additive fleet-wide plans.

1. Reasons, derived at read time — approvalDisplayReason renders a human sentence per plugin/action from the plan ("Node agent upgrade 0.3.0 -> 0.3.3 (edge-1)", "Line identity metadata sync (26 inbounds)", nft/dns/netpolicy/netguard/group-policy shapes covered, title-case fallback). Wired in toApprovalViews only — stored rows are never rewritten; existing approvals gain reasons with zero migration. A stored non-empty reason always wins.
2. Opt-in auto-approve policy — LATTICE_APPROVAL_AUTO_RULES / -approval-auto-rules JSON rules ({name, writer, plugin, action_prefix, queue, daily_cap}). Empty/absent (the default) is a pure pass-through — zero behavior change. All nine creation sites now funnel through submitApproval, which evaluates the first matching rule against fresh pending submissions only. The auto path calls the factored approveApprovalCore with the sha256 of the just-persisted plan, so the TOCTOU hash binding is byte-identical to the manual endpoint; the policy actor (policy:<name>) is stamped only after a successful decision, so failures never poison the daily cap. Audits: approval.auto_approve / approval.auto_skip (daily_cap), both attributable. Malformed config warns and starts with zero rules — startup never fails on it.

Verification

• go build ./... ; go vet ./internal/server/ ./cmd/... ; gofmt clean
• go test ./internal/server/ -run 'Approval|Policy|Reason' → ok
• Full suite go test ./internal/server/ -count=1 → ok 150s, no regressions
• 21-case reason table incl. malformed plans; policy tests cover default-off, first-match, cap (yesterday doesn't count), writer trust boundary, kill-switch failure path

Notes

• README Security Defaults documents the rule schema.
• Dashboard rendering of the reason field: any reasonably current dashboard shows it; the events wave (feat: approvals events, share deep links, motion rhythm, i18n key safety lattice-dashboard#13) surfaces it on cards.