sanad: coder panel P1a — approvals bridge, respond sidecar, web proxies

[osodev-1]

P1a of the coder-panel effort (spec: docs/superpowers/specs/2026-08-12-coder-agent-panel-design.md, plan: docs/superpowers/plans/2026-08-13-coder-panel-p1a-approvals-bridge.md).

The browser coder agent becomes interactive:

• Async on_request seam in WireRunner (architect reject-path unchanged)
• CoderRunner request bridge: ApprovalRequest/QuestionRequest → per-turn journal + pending registry; capabilities flipped to supports_question/plan_mode
• Fail-closed respond(): request_gone (410) / invalid_response (400, leaves request pending); strict pending check, never the wire layer's lenient id match
• POST /internal/coder/.../respond + pendingRequests in /turn; P0 deny golden test consciously replaced by a threaded HTTP approval round-trip
• Conversation cap (CODER_MAX_CONVERSATIONS=3, checked before ticket burn)
• Architect wall-clock budget (ARCHITECT_MAX_TURN_SECONDS=1800) — closes the P0 idle-probe unbounded-hold regression
• sanad-web /api/coder/* proxies behind authenticateCoderPanel (terminal allowlist → coder allowlist, both fail closed)

Verification: terminal-server suite 177 passed (12.5s); web suite 249 passed; tsc clean; final whole-branch review clean (carried items: journal-order hardening, respond/cancel race semantics, no-turn reject test → P1b brief).

Known fork-CI noise: pr-title-checker + typos fail on upstream Kimi artifacts, same as PR #1 — not required checks.