security: add authentication to dashboard approval API

[SafetyMP]

P1: Review dashboard /api/approvals decide endpoint for auth bypass (post-XSS fix PR #23).

[SafetyMP]

Upgraded to P0: entire control-plane API is unauthenticated — POST /api/approvals/:id/decide bypasses approval gates. See src/api/server.ts.