Service Approve Translations

MCP approval twin (task 755 → 1631): an agent flips translated/reviewed -> approved over the mcp:* scope (metered write, like the a11y-variant tools), so the review agent can "approve the good ones" in the SAME key it uses to propose. The HUMAN dashboard approve (review_router in translations.py) stays JWT-only.

Every approval is AUDITED (translation.status_changed, approval_kind=service, actor_api_key_uuid) — non-bypassable + distinguishable from human approvals — and now emits an enriched observability event via the meter (status_before -> approved, per key). Metered write but NOT separately billed (units=0: a status/governance change; the content was already billed at propose/update). Addressed by namespace/key/language_code (AI-native, no uuids). Idempotent: already-approved rows return unchanged; rows without an approvable value (missing/draft) error per item.