One-time command approvals

An approval-class request returns a short-lived browser URL and does not run the command. The approval page shows the client, command, exact arguments, and expiry.

Approval is bound to the same user, client, command, and arguments and can be consumed once. Expiry, replay, a changed argument, wrong user, wrong client, missing scope, lost capability, or disconnected app must fail without execution.

Never approve from a link delivered by an untrusted party without comparing the displayed client and exact operation. Cache and reverse proxies must not store the approval page.

Test success, decline, expiry, replay, changed arguments, and revocation before allowing an approval-class command in production.