Summary

• Represent remembered approvals as explicit permission rules such as Bash(...), Bash(...:*), and Edit(...), while keeping legacy rule compatibility.
• Add scoped session and persistent approval handling across desktop, CLI TUI, ACP, and serve UI so similar safe Bash commands and file mutations do not repeatedly prompt.
• Persist approval rules into project config with coverage/deduplication notices, and update docs plus approval mock artifacts.

Testing

• go test ./internal/permission ./internal/control ./internal/acp ./internal/i18n ./internal/serve ./internal/config ./internal/boot ./internal/cli
• npm --prefix desktop/frontend run check:css
• xmllint --noout docs/assets/approval-authorization-mocks.svg
• git diff --check

Addresses #3498