Update notification channels to include approval links

[helixclaw]

Summary

Update the Discord notification channel (and the NotificationChannel interface) to include an approval URL in notifications when WebAuthn is enabled.

Context

With WebAuthn, the approval mechanism shifts from Discord reactions to clicking a link. The notification still goes through Discord (or other channels), but now includes a clickable URL to the approval web UI.

Acceptance Criteria

• NotificationChannel interface updated:
  • sendApprovalRequest(request, options?) — options includes approvalUrl?: string
• DiscordChannel updated:
  • When approvalUrl is provided, embed includes a clickable "Approve" button/link
  • Embed format: request details + prominent approval URL
  • Reaction-based approval still works as fallback (if approval.requireWebAuthn is false)
• WorkflowEngine updated:
  • Generates approval URL: https://{server.host}:{server.port}/approve?requestId={id}&token={onetimeToken}
  • Passes URL to channel's sendApprovalRequest()
  • When WebAuthn required: does NOT poll for reactions, waits for server-side approval callback
  • When WebAuthn optional: polls reactions AND checks server-side approval (first wins)
• One-time approval tokens generated and stored server-side with 10-min TTL
• Unit tests: notification with link, workflow routing logic for WebAuthn vs reaction mode

Dependencies

• Implement WebAuthn-gated grant approval flow #69 (WebAuthn-gated approval flow)

Scope Boundaries

• Does NOT add new notification channels (just updates existing interface + Discord)
• Does NOT change the deny flow (deny can still be reaction-based or via web UI)