scratch matrix approval notifier, add chat-native MCP approval tools

Removes the entire Matrix-based notifier (internal/notifier/) that polled
for pending approvals, sent Matrix alerts, and checked for reaction-based
approve/deny. Approval decisions now work on any chat platform (Hermes
desktop, Telegram, Discord, WhatsApp, CLI) via two new MCP tools:

- list_approvals — query pending/recent approvals by status or entity
- decide_approval — approve/deny via same API endpoint as UI + nomos

Config fields removed: MatrixHomeserver, MatrixUserID, MatrixToken,
MatrixRoomID, ApprovalHMACSecret. Docker notifier: service removed.
Approval HMAC token generation removed (unused by code).

The existing chat-assent path in nomos (cmd/nomos/assent.go) and the
control-room Approve button keep working unchanged — both call the
shared POST /api/v1/approvals/{id}/decision endpoint.

scripts/seed-secrets.sh

@@ -49,16 +49,12 @@ seed_key() {
     fi
 }
 
-matrix_token="$(get_container_env notifier OIKOS_MATRIX_TOKEN)"
-approval_hmac="$(get_container_env notifier OIKOS_APPROVAL_HMAC_SECRET)"
 mcp_token="$(get_container_env api OIKOS_MCP_BEARER_TOKEN)"
 openrouter_key="$(get_container_env nomos OPENROUTER_API_KEY)"
 webhook_hmac="$(get_container_env api WEBHOOK_HMAC_SECRET 2>/dev/null)"
 
 api_token="$mcp_token"
 
-seed_key "matrix_token"         "$matrix_token"
-seed_key "approval_hmac-secret" "$approval_hmac"
 seed_key "mcp_bearer-token"     "$mcp_token"
 seed_key "api_token"            "$api_token"
 seed_key "openrouter_api-key"   "$openrouter_key"