complete MCP tool surface — Matrix approval webhook loop + token verification

Plan #6 (MCP Tool Completion / bin/homelab Migration) done.

- Approval records created for gated request_execution actions
- Notifier sends Matrix messages with HMAC approval tokens
- Stores matrix_event_id, polls /relations/{id}/m.annotation for ✅/❌
- Reaction detection triggers DecideApproval API call
- Token verification added to DecideApproval endpoint
- Migration 013: matrix_event_id + alert_sent_at on approvals
- AGENTS.md: 21-tool surface documented, stale homelab CLI refs removed
- Plan index updated, audit cross-reference refreshed

migrations/013_matrix_approval_tracking.up.sql

@@ -0,0 +1,5 @@
+-- Migration 013: Matrix approval tracking
+-- Adds matrix_event_id to approvals so the notifier can poll for reactions.
+
+ALTER TABLE approvals ADD COLUMN IF NOT EXISTS matrix_event_id TEXT;
+ALTER TABLE approvals ADD COLUMN IF NOT EXISTS alert_sent_at TIMESTAMPTZ;