dashboard: approval history tab on P3NDING APPR0VALS

new tabs above the approvals list: 'pending · N' and
'history · M'. active tab persists in localStorage so the
operator can park on history if they prefer. on a fresh
dashboard the default is pending (matches the prior shape).

history view shows the last 30 resolved approvals — newest
first by resolved_at — with one row per approval: status
glyph (✓ approved / ✗ denied / ⚠ failed), id, agent, kind,
short sha, status label, and a relative time chip. when the
row has a note (deny reason or build error), it renders
below in a muted block with line wraps preserved.

backend: Approvals::recent_resolved(limit) queries by
status IN ('approved', 'denied', 'failed') ORDER BY
resolved_at DESC. StateSnapshot gets approval_history (a
lean ApprovalHistoryView without diff_html — rendering 30
git diffs per state poll would be expensive and the operator
already saw the diff at decision time). dashboard's
history_view fn projects the sqlite row.

retires the matching TODO entry.

TODO.md

@@ -88,19 +88,6 @@ Pick anything from here when relevant. Cross-cutting design notes live in
 
 ## UI / UX
 
-- **Approval history tab on P3NDING APPR0VALS.** Today the
-  section renders pending rows only; once approved / denied /
-  failed they drop off the dashboard. Sqlite still has every
-  row (approvals table never deletes), and the meta git log +
-  applied repo's annotated `denied/<id>` / `failed/<id>` tags
-  already carry the human-readable reasons. A second tab —
-  `pending | history` — that scrolls the last N resolved
-  approvals with their terminal status, `resolved_at`
-  timestamp, operator note (deny), build error (failed), and
-  a quick link/diff to the `proposal/<id>` tag would close
-  the loop so the operator can see "what went out, what got
-  rejected, why" without ssh-ing to the host.
-
 - **Web UI for config repos + meta deploy log.** Browse
   per-agent proposed / applied tags
   (`proposal/* / approved/* / building/* / deployed/* /