feat(cli): backend-signed approval webhooks with submit-and-poll

[lukehinds]

• Sign every approval request with the enrollment key (nono-request-v1),
  stamping the six X-Nono-* headers a backend verifies.
• Derive <backend_url>/api/v1/approvals from enrollment state when url
  is omitted; require https or loopback http for signed requests.
• Follow the platform contract: submit, then poll
  GET /api/v1/approvals/{request_id} until a decision or timeout_secs.
• Send X-Nono-Timeout-Secs on every webhook request (signed or not) so
  the backend hold for the client's actual patience.
• Report elapsed time, not the configured timeout, in HTTP error denials.
• Reject auth on terminal and chain backends; keep the legacy single
  blocking POST for unsigned webhooks unchanged.

Checklist

• An issue exists and is linked above
• All commits are signed-off, using DCO
• All new code follows the project's coding standards (CLAUDE.md) and is covered by tests
• Public-facing changes are paired with documentation updates
• If this PR introduces a major feature, capability, or security-relevant change, a corresponding NEP has been opened or accepted and is linked

[github-actions]

PR Review Summary

Size

Metric	Value
Lines added	+1082
Lines removed	-54
Total changed	1136
Classification	Large (> 300 lines)

Affected crates

• crates/nono-cli — CLI changes. Verify argument parsing, flag documentation, and UX behaviour across supported platforms.

Blast radius — Broad

This PR touches: source code,documentation,configuration / policy files

---

_{Updated automatically on each push to this PR.}

[nogent-nolabs-ai]

nogent code review

No blocking issues; 0 findings.

Findings: none flagged in scope.

_{Automated code + security review. CI already covers clippy, rustfmt, tests, cargo-audit and commit-lint.}