complete MCP tool surface — Matrix approval webhook loop + token verification

Plan #6 (MCP Tool Completion / bin/homelab Migration) done.

- Approval records created for gated request_execution actions
- Notifier sends Matrix messages with HMAC approval tokens
- Stores matrix_event_id, polls /relations/{id}/m.annotation for ✅/❌
- Reaction detection triggers DecideApproval API call
- Token verification added to DecideApproval endpoint
- Migration 013: matrix_event_id + alert_sent_at on approvals
- AGENTS.md: 21-tool surface documented, stale homelab CLI refs removed
- Plan index updated, audit cross-reference refreshed

internal/db/sqlcgen/models.go

@@ -39,6 +39,8 @@ type Approval struct {
 	DecidedAt       *time.Time
 	DecidedBy       *uuid.UUID
 	CreatedAt       time.Time
+	MatrixEventID   *string
+	AlertSentAt     *time.Time
 }
 
 type ApprovalRule struct {