deny: operator can attach a reason that reaches the manager

clicking DENY on the dashboard now prompts for an optional reason
('reason for denying (optional, sent to manager):'). the value
rides along as a hidden 'note' form field; backend chain:

  POST /deny/{id} { note }
    → actions::deny(coord, id, Some(note))
    → Approvals::mark_denied writes it to the row
    → HelperEvent::ApprovalResolved { ..., note: Some("...") }

manager already had note: Option<String> on the event, just never
populated for denials before. host admin socket (hive-c0re deny)
still passes None.

generalized the prompt-on-submit pattern: any form with a
data-prompt attribute pops a window.prompt() before the POST and
stashes the answer in a hidden input named by data-prompt-field
(default 'note'). reusable for future opt-in note fields.

hive-c0re/src/approvals.rs

@@ -142,12 +142,12 @@ impl Approvals {
         })
     }
 
-    pub fn mark_denied(&self, id: i64) -> Result<()> {
+    pub fn mark_denied(&self, id: i64, note: Option<&str>) -> Result<()> {
         let conn = self.conn.lock().unwrap();
         let affected = conn.execute(
-            "UPDATE approvals SET status = 'denied', resolved_at = ?1
-               WHERE id = ?2 AND status = 'pending'",
-            params![now_unix(), id],
+            "UPDATE approvals SET status = 'denied', resolved_at = ?1, note = ?2
+               WHERE id = ?3 AND status = 'pending'",
+            params![now_unix(), note, id],
         )?;
         if affected == 0 {
             bail!("approval {id} not pending");