Record a human decision on an AI-screened item.

This is its own endpoint rather than a publishStatus PATCH because it records WHO decided and WHEN — an audit fact a plain status write cannot express. Approving satisfies the auto-publish gate; whether the item then actually publishes still respects the org's auto_publish setting, unless the caller explicitly asks to publish.