… is empty

When client_host is empty (proxy/unknown), reject the WebSocket connection
rather than silently allowing it. This prevents potential SSRF via
WebSocket connections when the client host cannot be determined.

Refs: PR NousResearch#15544

…ded in TUI shell.exec

tui_gateway/server.py exposes a shell.exec JSON-RPC method that
runs shell commands via subprocess.run(shell=True). It tries to
block dangerous commands using tools.approval.detect_dangerous_command,
but on ImportError silently falls through to executing the command:

    try:
        from tools.approval import detect_dangerous_command
        is_dangerous, _, desc = detect_dangerous_command(cmd)
        if is_dangerous:
            return _err(rid, 4005, f'blocked: {desc}...')
    except ImportError:
        pass    # <-- silently disables the guard, then runs anyway

If tools.approval cannot be imported (missing module, circular
import, syntax error in a dependency, partial deploy), the screener
is skipped and arbitrary shell commands reach subprocess.run.

Fix:

* Replace the silent ImportError pass with a fail-closed return:
  error code 4006 with message 'dangerous-command guard unavailable;
  refusing to execute'. Consistent with the fail-closed pattern
  applied to the cron SSRF check in NousResearch#10180 and the WebSocket
  empty-peer guard in NousResearch#15544.

No behavior change when tools.approval is available -- the existing
detect_dangerous_command path runs unchanged, dangerous commands
still return 4005, and safe commands still flow through to
subprocess.run.

Regression tests added in tests/test_tui_gateway_server.py:

* test_shell_exec_fails_closed_when_guard_unavailable -- injects an
  ImportError for tools.approval via a patched builtins.__import__
  and a tripwire on subprocess.run; asserts the response is error
  4006 with 'guard unavailable' in the message and that
  subprocess.run is never reached.

* test_shell_exec_still_runs_when_guard_available -- guards against
  over-reach: with tools.approval present and the command not
  flagged dangerous, shell.exec must still execute. Without this
  the fail-closed change could regress into 'refuses everything'.

Verified locally that the fail-closed test fails without this
patch (the response carries error code 5003 from the tripwire-raised
AssertionError inside subprocess.run, proving the silent-skip path
was reached) and passes with the fix in place. The 205 pre-existing
tests in test_tui_gateway_server.py are unaffected by this change.

Per @egilewski's audit on this PR (NousResearch#15542), the original April patch
targeted the same fail-open path; the file has refactored heavily
since (tui_gateway/server.py is now ~8k lines vs ~4.6k at the
original PR head), so this commit re-applies the fail-closed
behavior at the current shell.exec call site and adds the
regression coverage that the original PR was missing.