plan-approve-once policy + cooler empty states + remove graph header

Backend:
- proposePlan sets plan window in autonomy_settings (nomos:plan:<session>)
- run handler checks plan window — auto-executes config_mutation commands
  within plan without per-action approval
- planWindowActive function in server.go
- Plan window cleaned up on completeTask (already covered by LIKE '%:' || )

Frontend:
- Removed 'Session graph' header bar
- Cooler empty states: Plan shows animated dots + 'Awaiting plan…',
  Activity shows pulsing dots + 'Waiting for activity…'

web/src/lib/components/ActivityTimeline.svelte

@@ -43,8 +43,13 @@
 <div class="flex h-full flex-col">
   <div class="flex-1 overflow-y-auto">
     {#if $activityLog.length === 0}
-      <div class="px-3 py-6 text-center text-xs text-muted-foreground">
-        Waiting for agent activity…
+      <div class="flex flex-col items-center gap-2 px-3 py-6 text-center">
+        <div class="flex items-center gap-0.5">
+          <div class="size-1 rounded-full bg-muted-foreground/20 animate-pulse" style="animation-delay:0s" />
+          <div class="size-1 rounded-full bg-muted-foreground/30 animate-pulse" style="animation-delay:0.15s" />
+          <div class="size-1 rounded-full bg-muted-foreground/20 animate-pulse" style="animation-delay:0.3s" />
+        </div>
+        <p class="text-xs text-muted-foreground">Waiting for activity…</p>
       </div>
     {:else}
       <div class="flex flex-col py-1">