feat(assistant): add approval inbox and e2e hardening

packages/db/prisma/schema.prisma

@@ -201,6 +201,7 @@ model User {
   comments           Comment[]
   activeSessions     ActiveSession[]
   reportTemplates    ReportTemplate[]
+  assistantApprovals AssistantApproval[]
 
   createdAt         DateTime  @default(now())
   updatedAt         DateTime  @updatedAt
@@ -208,6 +209,13 @@ model User {
   @@map("users")
 }
 
+enum AssistantApprovalStatus {
+  PENDING
+  APPROVED
+  CANCELLED
+  EXPIRED
+}
+
 enum ReportTemplateEntity {
   RESOURCE
   PROJECT
@@ -234,6 +242,27 @@ model ReportTemplate {
   @@map("report_templates")
 }
 
+model AssistantApproval {
+  id             String                  @id @default(cuid())
+  userId         String
+  conversationId String
+  toolName       String
+  toolArguments  String                  @db.Text
+  summary        String
+  status         AssistantApprovalStatus @default(PENDING)
+  approvedAt     DateTime?
+  cancelledAt    DateTime?
+  expiresAt      DateTime
+  createdAt      DateTime                @default(now())
+  updatedAt      DateTime                @updatedAt
+
+  user           User                    @relation(fields: [userId], references: [id], onDelete: Cascade)
+
+  @@index([userId, conversationId, status, expiresAt])
+  @@index([status, expiresAt])
+  @@map("assistant_approvals")
+}
+
 model Account {
   id                String  @id @default(cuid())
   userId            String