Unanswered approval prompts queue silently and desync all subsequent requests

## Environment

aac 0.11.0 (3b000d15), bw 2026.5.0, macOS 26.5.1 (arm64), default relay, provider and consumer on the same machine.

## Summary

Credential approval prompts in the `aac listen` TUI queue silently with no TTL and no staleness indication. If one prompt goes unanswered past the consumer's timeout, every subsequent request gets answered one cycle late and the whole flow desyncs until the operator manually denies the stale prompt.

## Repro

1. Consumer: `aac run --domain example.com --env X=password -- cmd` (default 120s timeout). Do not answer the TUI prompt; let the consumer time out.
2. Consumer: run the same command again.
3. Now answer the prompt showing in the TUI (it still belongs to request 1).
4. The second consumer logs `Ignoring response with mismatched request_id: Some("req-...")` and times out, even though the operator pressed approve while it was waiting. Each retry repeats the pattern, always one request behind.

## Impact

- The operator believes they approved the live request; the consumer times out anyway. Very confusing to debug without client logs.
- Approving a stale prompt transmits the credential through the tunnel even though the requester already disconnected.

## Suggestions

- Expire/dismiss a pending prompt when the requesting client disconnects or its request times out.
- Show request age on the prompt, and surface a queue depth indicator when more than one request is pending.
- Allow the consumer to cancel an in-flight request on exit so the provider can clean up.

Reproduce the sequence with `aac listen` and two `aac run --domain example.com --env X=password -- cmd` requests, then trace the `request_id` mismatch handling and prompt lifecycle. Done means an unanswered or disconnected request no longer desynchronizes later requests, and stale prompts are visibly handled or dismissed.

Written by the indexing model from the issue text.