#268 feat(dash): arm-then-confirm approve control

[Anonymous]

Originally created by: fu351

Summary

• The dash pending-card Approve button is now arm-then-confirm: the first click arms it ("Confirm approve"), a second click within 3 seconds resolves, and the timer disarms it back to "Approve". Deny stays single-click - denying is the safe direction, so it earns no friction.
• Client-side only: the arming lives in _HTML_SHELL's render loop (one timer per card); server-side approval semantics are untouched.
• Rides along: the dash command docstring dropped its stale "polish lands in a later slice" promise - the polish has landed.

Tests

• test_shell_approve_requires_arm_then_confirm (red-green cycle confirmed before implementation)
• ruff / lint-imports (2 contracts kept) / test_dash_serve.py green locally

Repo: core. No enterprise references; dash HTML shell and one CLI docstring only.

Part of the 2026-08-05 UX fix wave (critique: approving an AUTH challenge is the highest-stakes click in the product and had zero slip protection).

[Anonymous]

Ticket changed by: fu351

• status: open --> closed