Add approval request HTTP surface

crates/crank-registry/src/migrations.rs

@@ -559,6 +559,35 @@ pub async fn apply_postgres(pool: &PgPool) -> Result<(), sqlx::Error> {
     .execute(pool)
     .await?;
 
+    query(
+        "create table if not exists approval_requests (
+            id text primary key,
+            workspace_id text not null references workspaces(id) on delete cascade,
+            agent_id text not null references agents(id) on delete cascade,
+            operation_id text not null references operations(id) on delete cascade,
+            operation_version integer not null,
+            status text not null,
+            risk_level text not null,
+            confirmation_title text not null,
+            confirmation_body text not null,
+            request_payload_json jsonb not null,
+            response_payload_json jsonb null,
+            created_at timestamptz not null,
+            expires_at timestamptz not null,
+            decided_at timestamptz null,
+            decided_by_key_id text null references platform_api_keys(id) on delete set null,
+            decision_note text null
+        )",
+    )
+    .execute(pool)
+    .await?;
+    query(
+        "create index if not exists approval_requests_agent_status_idx
+         on approval_requests(workspace_id, agent_id, status, expires_at)",
+    )
+    .execute(pool)
+    .await?;
+
     query(
         "create table if not exists invocation_logs (
             id text primary key,