[Duang777]

Summary

• add stale-safe approve, deny, and reply actions with adjacent redacted audit events
• issue device-bound, one-time Web Push tickets and consume them before PTY execution
• add notification actions and an inline PWA approval view with a bounded live screen
• defer terminal attachment on notification deep links so opening an approval cannot resize the pending prompt
• document setup, security limits, and package ownership

Verification

• go test -race ./internal/notify ./internal/respond ./internal/api ./internal/daemon -count=1
• go vet ./...
• make build
• scripts/check-workspace-platforms.sh
• npm --prefix web run typecheck
• npm --prefix web test -- --run (82 tests)
• DROVE_E2E_USE_SYSTEM_CHROME=1 npm --prefix web run test:e2e (6 scenarios)
• npm --prefix web run build
• generated-asset scan for test tickets, reply fixtures, and secrets

Physical iOS and Android delivery was not available in this environment. Chrome verified Service Worker push and click behavior against a real daemon.

Closes #28