Worker approvals

Pending items only — GET /api/approvals/pending. No missions, no local restoration queue.

Real pipeline only. This page loads and acts on the Lantern Worker approvals API. Approve / Reject / Return call POST /api/approvals/* with credentials: 'omit' (same CORS pattern as working mission fetches).