dashboard: extract operator-inbox + approvals into call.js (#1451)

Begin splitting the tabs.js monolith: lift the Y3R C4LL domain into a new
call.js module (mirrors permissions.js / schedules.js).

- questionsState + QUESTION_HISTORY_LIMIT move to state.js: they're read by
  both the SW4RM container rows (per-agent question-count badges) and the
  Y3R C4LL questions domain, so they're cross-domain shared state.
- operator-inbox domain (state + refresh/render/mark/append) → call.js.
- approvals domain (state + sync/apply/render/diff-panel/history) → call.js.
- call.js exposes count getters (activeApprovalCount, operatorInboxCount);
  the entry's refreshTabCounts pulls them. Live-mutation paths call an
  injected onCountsChanged callback (registered via initCall at boot)
  instead of reaching into the coordinator (avoids a circular import).
- renderPeerHives, physically interleaved in the moved range but part of
  the SW4RM/peers domain, stays in tabs.js.

Behaviour-preserving; no visual change. Questions domain follows next.

(Recreated after a harness-restart git-object corruption; identical content.)

frontend/packages/dashboard/src/state.js

@@ -23,3 +23,13 @@ export function syncContainersFromSnapshot(s) {
   containersState.clear();
   for (const c of s.containers || []) containersState.set(c.name, c);
 }
+
+// Derived question state — the other genuinely cross-domain store. Owned by
+// the Y3R C4LL questions domain (`call.js`: cold-loaded from /api/state, then
+// mutated live by `question_added` / `question_resolved` events), but also
+// read by the SW4RM container rows, which render per-agent asker/target
+// question-count badges off `questionsState.pending`. It lives here for the
+// same reason as `containersState`: a single source of truth both domains
+// import by reference rather than threading through call signatures.
+export const QUESTION_HISTORY_LIMIT = 20;
+export const questionsState = { pending: [], history: [] };