Freigabe durch die Leitung innerhalb von Grenzen (#687)

- UnitConfig.Approvals: Operationen, Hoechstzahl je Tag, Stunden je Freigabe; nur der
  Mensch setzt sie (OrgAdministration.SetApprovals mit Audit, Teilmengenregel nach oben,
  Senken oben senkt unten mit; Agentenaenderungen/Sonderbudget nie freigebbar)
- LeadApprovals: Vorlage geht an die naechste Leitung, deren Einheit die Operation
  erlaubt; nie eigene Aufrufe, nie eine Leitung mit Fremdinhalt, Tagesdeckel, Frist.
  Entscheidung ueber Escalation approve_call/reject_call, im Audit als lead:<id>
- Der Mensch sieht alles und kann zuerst entscheiden; danach wird die Leitungsaufgabe
  geschlossen. Nach der Frist nur noch der Mensch.
- StagedCalls: Approver, ApproverUntil, ApproverTaskId (Nachruestung)
- WebUI: Hinweis "bei Leitung" in der Freigabestelle, Zaehler ohne diese, Quote je
  Leitung; Karte in der Organisationsansicht; i18n en/de
- Tests: LeadApprovalsTests (13), OrgAdministrationTests (+2)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/ClawdDotNet.Core/Config/UnitConfig.cs

@@ -49,6 +49,45 @@ public sealed class UnitConfig
     /// <summary>Starting values for agents that join this unit.</summary>
     [JsonPropertyName("defaults")]
     public UnitDefaults Defaults { get; set; } = new();
+
+    /// <summary>
+    /// #687: What the lead of this unit may approve for the agents below it; <c>null</c> means
+    /// nothing — every approval goes to a human. Set only by a human.
+    /// </summary>
+    [JsonPropertyName("approvals")]
+    public UnitApprovals? Approvals { get; set; }
+}
+
+/// <summary>
+/// #687: The limits within which a unit's lead approves instead of the human. They belong to
+/// the unit, not to the lead as a person — otherwise the power moves with an agent that changes
+/// its post, and a vacant lead would have none.
+/// </summary>
+public sealed class UnitApprovals
+{
+    /// <summary>
+    /// The operations the lead may approve: <c>Tool.operation</c>, or <c>Tool</c> for all of its
+    /// operations. A sub-unit can grant no more than every unit above it that grants anything.
+    /// </summary>
+    [JsonPropertyName("operations")]
+    public List<string> Operations { get; set; } = [];
+
+    /// <summary>Approvals the lead may give in 24 hours; beyond that the human decides.</summary>
+    [JsonPropertyName("perDay")]
+    public int PerDay { get; set; } = 20;
+
+    /// <summary>How long the lead has; after that the call is the human's alone.</summary>
+    [JsonPropertyName("hours")]
+    public double Hours { get; set; } = 4;
+
+    [JsonIgnore]
+    public TimeSpan Window => TimeSpan.FromHours(Math.Clamp(Hours, 0.25, 72));
+
+    /// <summary>Whether this grant covers the operation.</summary>
+    public bool Covers(string tool, string? operation)
+        => Operations.Any(o => string.Equals(o, tool, StringComparison.OrdinalIgnoreCase)
+                               || (!string.IsNullOrWhiteSpace(operation)
+                                   && string.Equals(o, $"{tool}.{operation}", StringComparison.OrdinalIgnoreCase)));
 }
 
 /// <summary>