Workflows: links in emails that open an entry ready to act, and optional signed one-click approvals

Arnel, 14 September 2026: the nightly sweep records absences (#835) and emails each teacher; the teacher signs in and explains an absence; the department head gets an email, clicks the link, and approves. States, named transitions with per-role permissions and workflows on transitions already do most of this (docs/approval-by-configuration.md). An email cannot link to the thing to approve.

## Change

**Links as placeholders.**
- `{{links.console}}` opens the entry in barakoBrew, for example `/content/{{id}}`, using the console's base URL from configuration.
- `{{links.site "/approvals/{{id}}"}}` opens a page on the tenant's site, using the site settings `Url` (#793), for approvers who use a portal page with a transition button (BaryoDev/barakoPress#26, #7).
- `{{links.transition "Approve"}}` opens the entry with that transition ready to confirm. The approver still signs in, and the transition's own permission and conditions decide whether the button works.

**One-click action links, optional, off by default.**
- A signed token for one transition, on one entry, for one user: single use, expires (default 72 hours), never logged.
- Opening it shows a confirmation page ("Approve absence for Juan, 15 September?") rather than acting on the GET, so mail scanners that follow links cannot approve anything.
- The transition still runs as that user, with their permissions and row conditions checked at the moment of approval, and a note field when the transition requires one (#809).
- Revoked when the entry leaves the state, or when the user loses the role.

## Done when

- A workflow email's `{{links.transition "Approve"}}` opens the entry in barakoBrew with Approve ready, and a user without the permission sees why it is unavailable.
- With action links on, a link approves once after confirmation, fails a second time, fails after expiry, and a GET alone changes nothing.

## Where it lives

Core: the link placeholders resolve in `TemplateVariableExtractor`, and signed action tokens are issued and checked by the core's auth, the same place other tokens are.

Start with docs/approval-by-configuration.md, then inspect TemplateVariableExtractor for placeholder resolution and the core authentication code where other tokens are issued and checked. Trace how workflow transitions enforce permissions and conditions. Done means console, site, and transition links work as specified, while optional signed links require confirmation, are single-use and expiring, and never change state on GET alone.

Written by the indexing model from the issue text.