feat(v0.3): H3 — remote approve/reject (no typing)

- types/protocol: ClientMessage approve/reject; ServerMessage status.pending
- server: POST /hook/permission HELD until the client decides; approve/reject
  ws messages resolve it with {hookSpecificOutput.decision.behavior allow|deny};
  5-min timeout + release-on-disconnect fall back to Claude's own prompt
- manager.handleHookEvent threads pending flag
- setup-hooks: PermissionRequest uses the held curl (writes decision to stdout);
  status events stay fire-and-forget
- FE: terminal-session approve()/reject() + pending state; tabs approval banner
  (Approve/Reject) for the active tab's held request
- Tests: protocol approve/reject; integration ⑧ held→approve→allow. 207 green.
- Browser-verified: banner 'Claude wants to use Bash' → Approve → resolves allow.

src/protocol.ts

@@ -24,7 +24,7 @@ export const SESSION_ID_RE =
 
 // ─── Type whitelist ───────────────────────────────────────────────────────────
 
-const ALLOWED_TYPES = new Set<string>(['attach', 'input', 'resize'])
+const ALLOWED_TYPES = new Set<string>(['attach', 'input', 'resize', 'approve', 'reject'])
 
 // ─── parseClientMessage ───────────────────────────────────────────────────────
 
@@ -73,6 +73,14 @@ export function parseClientMessage(raw: string): ParseResult {
     return validateInput(obj)
   }
 
+  // approve/reject (H3) carry no payload.
+  if (type === 'approve') {
+    return { ok: true, message: { type: 'approve' } }
+  }
+  if (type === 'reject') {
+    return { ok: true, message: { type: 'reject' } }
+  }
+
   // type === 'attach'
   return validateAttach(obj)
 }