fix: accept query token on dashboard settle POST

[linhdmn]

Summary

• POST /api/approvals/:id now accepts ?token= the same way GET dashboard routes do (header still works).
• Closes KNOWN-ISSUES §5: scripted clients no longer get a 401 that looks like a wrong secret when they only have the printed dashboard URL.
• sameOrigin still blocks cross-origin browser POSTs.

Why

The settle route authorized against a placeholder URL with allowQuery: false, so the real request’s query token was discarded. Read routes already accepted query tokens; the two halves of one tiny API disagreed.

Test plan

• node --experimental-strip-types --test test/dashboard.test.ts — 40/40 (includes new query-token settle test)
• Full unit suite — 385/385
• tsc --noEmit pass
• bash .githooks/pre-commit --all pass
• Live unit: settle with query token only (no header) → 200 {"ok":true,"outcome":"allowed-once"}
• Live model HITL on hermetic test DSH (flhead): SSE watcher + settle via ?token= only → file written query-token-ok
• Invalid query token still 401; header still wins when both present

Evidence

Under docs/evidence/settle-query-token-live/:

• result.txt — settled=1, got=query-token-ok
• settle-query-response.json — {"ok":true,"outcome":"allowed-once"}
• Feature brief: docs/FEATURE-settle-query-token.md

Hermetic home used: ~/.dsh-fl-local-evid (profiles flevid / flhead), harness 0.2.0-rc.1, plugin built from this worktree.

[linhdmn]

Superseded by #45, which is this same commit rebased onto main (3534097, v0.4.2) with the conflict resolved.

This branch is 1 ahead / 32 behind main and has been CONFLICTING since 2026-09-30: main grew grantOwnAsk (run-scoped approval, #43) directly above the approve definition this fix rewrites. The rebased branch keeps grantOwnAsk verbatim and changes only approve's signature and its authorized(...) call.

Verified on the rebased tree: full suite 819 pass / 0 fail, test/dashboard.test.ts 40/40 including the new query-token settle test, tsc --noEmit clean, pre-commit scan clean.

Closing this one in favour of #45; the branch dsh/dashboard-settle-query-token can be deleted once #45 lands.