flagon-io/g1t

Part of #311, the first slice. This PR does not close it.

• Told once when a call waits. When a hosted session's call starts waiting for approval, whoever started the session gets an inbox item under Needs you. It is sent exactly once per call (KEEP_WAITING … RETURNING), and the item is settled when the call is answered, declined after 10 minutes, or its session ends. integrations gains an optional EVENTS binding (the same pattern as identity's token approvals).
• Allow / Deny from Needs attention, on any page, through a new -/approvals action that uses the same answer_agent_session checks as the session page. The card and the session page share ApprovalWhat and AnswerButtons. Each call shows once: the inbox item is dropped whenever the call itself is listed. A refusal says why, then the card leaves.
• Recents replaces Direct messages in Chat's sidebar. It lists your agent sessions beside your DMs, newest first, each with a status dot: working, waiting on you, idle or ended. Data comes from -/recents.json, keyed per workspace, and refreshes on focus, live notifications and session changes. There is no polling.
• Docs: the Chat, sessions and notifications guides, work/sessions, workspaces, and the architecture services table.

Validation:

• cargo tests for contracts, events and integrations with -D warnings, plus workspace and wasm32 checks;
• the contracts package;
• conformance (78);
• web typecheck, tests (1174), build, load-check and deploy-check;
• test:deploy, the manifest check, astro build and prettier;
• screenshots of the sidebar, the card in its states, dark mode and phone width.