feat: surface structured permission details in approval UI

Wire the sidecar's new permissionDetail payload through the frontend:
- Add PermissionDetail interface to sidecar contract
- Add permissionDetail field to PendingApprovalRecord and thread
  through normalization and AryxAppService mapping
- Create PermissionDetailView component with kind-specific rendering:
  shell (command block + warning), write (filename + diff), read (path),
  mcp (server badge + args), url (prominent URL), memory (subject/fact),
  custom-tool (description + args), hook (message + args)
- ApprovalBanner shows structured detail when available, falls back to
  generic text for backward compatibility
- QueuedApprovalsList shows brief kind-specific summaries

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

src/shared/domain/approval.ts

@@ -1,3 +1,5 @@
+import type { PermissionDetail } from '@shared/contracts/sidecar';
+
 export type ApprovalCheckpointKind = 'tool-call' | 'final-response';
 export type ApprovalStatus = 'pending' | 'approved' | 'rejected';
 export type ApprovalDecision = Exclude<ApprovalStatus, 'pending'>;
@@ -35,6 +37,7 @@ export interface PendingApprovalRecord {
   title: string;
   detail?: string;
   messages?: PendingApprovalMessageRecord[];
+  permissionDetail?: PermissionDetail;
 }
 
 export interface PendingApprovalState {
@@ -290,6 +293,7 @@ export function normalizePendingApproval(
     title,
     detail: normalizeOptionalString(approval?.detail),
     messages: normalizePendingApprovalMessages(approval?.messages),
+    permissionDetail: approval?.permissionDetail,
   };
 }