[Feature] Simplify approval commands: short aliases + session/always scopes

## Simplify approval commands: short aliases + session/always scopes

> **中文摘要：** `/approve` 和 `/deny` 短命令已在 v1.1.7 中实现，但帮助文本和审批提示中未提及，用户不知道。本 issue 补充 `/session`、`/always`、`/reset` 命令，增加作用域支持（once/session/always），并更新提示文本。

### Background

Short commands `/approve` and `/deny` were already implemented in v1.1.7 (commit `9658e38b`). However:

1. The help text and approval prompts still show only `/approval approve`/`/approval deny`
2. No `session` or `always` scopes exist for persistent trust
3. No way to clear trust rules

### Proposed Changes

#### 1. Update prompts to mention short commands

All user-facing text should mention `/approve` and `/deny`:

| File | Current | Should be |
|---|---|---|
| `approval_handler.py:_usage_hint()` | `/approval approve` | `/approve` (mention both) |
| `approval_handler.py:_handle_list()` | `/approval approve ` | `/approve ` / `/deny ` |

#### 2. New commands

| Command | Function |
|---|---|
| `/session` | Trust this tool type for the current session |
| `/always` | Permanently whitelist this tool |
| `/reset` | Clear all session/always trust rules |

#### 3. Scope parameter on existing commands

```
/approve # approve once (current)
/approve session # approve for this session (new)
/approve always # permanently approve (new)
```

Or as standalone commands:
```
/session # approve current pending for session
/always # approve current pending permanently
```

#### 4. Session/always persistence

- `always` rules: stored in `config.json` → `security.approved_tools`
- `session` rules: in-memory, keyed by `root_session_id`, cleared on session end