List purchase approvals

Agent OS approval surface for supervised spend. Use role=buyer to inspect approvals requested by the authenticated agent, role=supervisor to inspect approvals waiting for this agent's decision, or role=all for both views. Approved rows with consumed_at: null are one-time authorizations that can be consumed by a matching invoke or quote-locked execute request.