fix(web-ui): make approval commands fully readable

[guantw]

Summary

• Show permission resources on a separate multiline row with wrapping, bounded vertical scrolling, and keyboard access.
• Keep approval actions outside the scrolling content and wrap long risk descriptions.

Type and Areas

Type: Bug fix / UI/UX

Areas: Web UI, chat composer, permission approvals

Motivation / Impact

Long commands are reduced to a single truncated line in the approval band, making it difficult to inspect the full operation before answering. The complete command can now be read directly in the band, including its original line breaks, while the approval controls remain accessible in narrow layouts.

Verification

On the rebased head:

• pnpm run check:web — passed, including TypeScript, appearance, typography, and theme governance checks.
• pnpm --dir src/web-ui run test:run src/flow_chat/components/ChatInputApprovalBand.test.tsx src/flow_chat/components/ChatInputWorkspaceStripLayout.test.ts — 35 tests passed.
• git diff --check origin/main...HEAD — passed.

Manual validation of the UI change:

• Local browser checks at 1024, 560, 360, and 240 px widths: no horizontal overflow and approval actions remained visible.
• Keyboard scrolling reached the end of a long multiline command; narrow-layout batch approval remained usable.
• The Windows x64 Debug build and desktop frontend build passed before rebasing, and the reporter confirmed the fix works. Desktop packaging was not repeated after the rebase.

Reviewer Notes

• Retains the existing composer width constraints and warning theme tokens. Approval scope, saved grants, reply callbacks, and transport behavior are unchanged.
• Live remote workspace, remote control, Peer Device Mode, and Detached Dispatch scenarios were not exercised; verification covered local rendering and component behavior.
• AI-assisted. Testing level: lightly tested (focused automated checks and local manual validation; no live remote coverage).
• No new user-facing strings or persisted data changes.

Checklist

• This PR is focused and does not include secrets, temporary prompts, generated scratch files, or unrelated artifacts.
• Relevant verification is recorded above, or skipped checks are explained.
• User-facing strings, docs, and locales are updated where applicable.