feat(grpc): add tool approval flow for Chat/SessionChat RPCs

Summary

The REST API supports an interactive tool approval flow for chat:

1. POST /api/chat streams SSE events including approval_request when a tool invocation needs human approval
2. POST /api/chat/:chatId/approve resolves the pending approval (approve or deny)

The gRPC Chat and SessionChat RPCs support streaming responses but have no equivalent approval mechanism. This means gRPC clients cannot replicate the dashboard's interactive chat-with-approval UX.

Proposal

Design a gRPC-native approval flow. Options include:

1. Bidirectional streaming — extend Chat/SessionChat to accept client-to-server approval messages mid-stream
2. Separate approval RPC — add an ApproveToolCall(chatId, toolCallId, approved) unary RPC that resolves pending approvals, mirroring the REST endpoint
3. Callback pattern — use the existing VSCodeStream bidirectional channel to relay approval requests/responses

Option 2 is simplest and most consistent with the REST pattern.

Context

Identified during gRPC config parity audit in #32.

Start by comparing the gRPC Chat and SessionChat RPC definitions and streaming implementations with the REST approval flow at POST /api/chat and POST /api/chat/:chatId/approve. Review the existing VSCodeStream bidirectional channel and the context from #32 before choosing an approach. Done means a documented gRPC approval design that lets clients receive approval requests and approve or deny pending tool calls.