scratch matrix approval notifier, add chat-native MCP approval tools

Removes the entire Matrix-based notifier (internal/notifier/) that polled
for pending approvals, sent Matrix alerts, and checked for reaction-based
approve/deny. Approval decisions now work on any chat platform (Hermes
desktop, Telegram, Discord, WhatsApp, CLI) via two new MCP tools:

- list_approvals — query pending/recent approvals by status or entity
- decide_approval — approve/deny via same API endpoint as UI + nomos

Config fields removed: MatrixHomeserver, MatrixUserID, MatrixToken,
MatrixRoomID, ApprovalHMACSecret. Docker notifier: service removed.
Approval HMAC token generation removed (unused by code).

The existing chat-assent path in nomos (cmd/nomos/assent.go) and the
control-room Approve button keep working unchanged — both call the
shared POST /api/v1/approvals/{id}/decision endpoint.

internal/scheduler/backup.go

@@ -17,7 +17,7 @@ import (
 // since the first seed, but nothing ever verified that a backup actually
 // happened — a silent backup failure looked exactly like a working one. This
 // makes staleness a Signal like any other, so it flows through the existing
-// dedup, auto-resolve and notifier path rather than needing its own machinery.
+// dedup, auto-resolve and webhook path rather than needing its own machinery.
 //
 // Config: {"path": "/opt/oikos/backups", "max_age_s": 86400, "host": …}
 //