feat: implement approval state machine (Task 13)

[itenev]

Summary
Implements the approval state machine and fatigue prevention logic (Task 13) for action proposals. This ensures operators are not spammed with repeated identical proposals, enforces cooldowns, and automatically escalates when an action times out multiple times.

Type of Change
- [ ] Bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected)
- [x] Documentation update

Pre-Review Findings and Resolutions
<!-- Hermes pre-review checklist. Fill this out before requesting human review. -->
- [x] Linting/formatting (ruff check --fix && ruff format) applied before pre-review.
- [x] Any runbook loading/YAML changes include an end-to-end test loading the physical file. (N/A for this PR)
- [x] Design contracts verified (single-writer boundary maintained, no new violations introduced).
- Findings flagged by Hermes: 
  - None. The implementation cleanly separates state machine logic from the database layer and handles edge cases (e.g., already suppressed actions) gracefully.
- Resolutions applied:
  - N/A

Testing
- [x] All existing tests pass (pytest -v --cov=agentic_node_ops --cov=webhook_receiver — 148 tests passed, 90% coverage)
- [x] New tests added for new functionality (tests/test_approval.py includes 12 tests covering fatigue rules, escalation, and proposal grouping)
- [x] Manual verification steps (if applicable): N/A (fully covered by unit tests using temporary in-memory SQLite databases)

Checklist
- [x] My code follows the style guidelines of this project
- [x] I have performed a self-review of my own code
- [x] I have commented my code, particularly in hard-to-understand areas
- [x] I have made corresponding changes to the documentation (docs/hermes-implementation-plan.md)
- [x] My changes generate no new warnings or errors