Bind approvals and budgets to authorization context

[FranklinNexus]

What changed

• bind approval grants to a versioned canonical intent, session, policy version, and budget scope
• enforce budget-scope idempotency and cross-session replay blocking
• return fail-closed receipts for unavailable approval and budget dependencies
• publish v0.3.0 receipt and intent contracts in the API and workbench
• update FastAPI and setup-python dependency bounds

Why

Intent ids alone did not prevent payload or authorization-context substitution. The public reference now makes authority, budget ownership, and receipt fields explicit and testable.

Verification

• 57 tests with warnings treated as errors
• Ruff, compileall, and pip check
• clean Python 3.12 container
• Docker build and nine-scenario HTTP smoke test
• desktop and 390px responsive browser review with no console errors or horizontal overflow