approval lifecycle entries in Activity timeline

- activityLog now detects 'requires approval' in tool results
- Adds approval entries with shield icon + description + execution ID
- Works for both run and remaining approval paths

web/src/lib/components/ActivityTimeline.svelte

@@ -8,6 +8,7 @@
   import SparklesIcon from '@lucide/svelte/icons/sparkles'
   import HelpCircleIcon from '@lucide/svelte/icons/help-circle'
   import FlagIcon from '@lucide/svelte/icons/flag'
+  import ShieldIcon from '@lucide/svelte/icons/shield'
   import ChevronDownIcon from '@lucide/svelte/icons/chevron-down'
   import ChevronRightIcon from '@lucide/svelte/icons/chevron-right'
 
@@ -29,6 +30,7 @@
       case 'knowledge': return SparklesIcon
       case 'complete': return FlagIcon
       case 'question': return HelpCircleIcon
+      case 'approval': return ShieldIcon
       default: return null
     }
   }