plan-approve-once policy + cooler empty states + remove graph header

Backend:
- proposePlan sets plan window in autonomy_settings (nomos:plan:<session>)
- run handler checks plan window — auto-executes config_mutation commands
  within plan without per-action approval
- planWindowActive function in server.go
- Plan window cleaned up on completeTask (already covered by LIKE '%:' || )

Frontend:
- Removed 'Session graph' header bar
- Cooler empty states: Plan shows animated dots + 'Awaiting plan…',
  Activity shows pulsing dots + 'Waiting for activity…'

web/src/lib/components/TaskContextPanel.svelte

@@ -144,8 +144,13 @@
             {/each}
           </ol>
         {:else}
-          <div class="px-3 py-3 text-center text-xs text-muted-foreground">
-            No plan yet
+          <div class="flex flex-col items-center gap-2 px-3 py-6 text-center">
+            <div class="flex gap-1">
+              <div class="size-1.5 rounded-full bg-muted-foreground/20" />
+              <div class="size-1.5 rounded-full bg-muted-foreground/30" />
+              <div class="size-1.5 rounded-full bg-muted-foreground/20" />
+            </div>
+            <p class="text-xs text-muted-foreground">Awaiting plan…</p>
           </div>
         {/if}
       </div>