Freigabe durch die Leitung innerhalb von Grenzen (#687)

- UnitConfig.Approvals: Operationen, Hoechstzahl je Tag, Stunden je Freigabe; nur der
  Mensch setzt sie (OrgAdministration.SetApprovals mit Audit, Teilmengenregel nach oben,
  Senken oben senkt unten mit; Agentenaenderungen/Sonderbudget nie freigebbar)
- LeadApprovals: Vorlage geht an die naechste Leitung, deren Einheit die Operation
  erlaubt; nie eigene Aufrufe, nie eine Leitung mit Fremdinhalt, Tagesdeckel, Frist.
  Entscheidung ueber Escalation approve_call/reject_call, im Audit als lead:<id>
- Der Mensch sieht alles und kann zuerst entscheiden; danach wird die Leitungsaufgabe
  geschlossen. Nach der Frist nur noch der Mensch.
- StagedCalls: Approver, ApproverUntil, ApproverTaskId (Nachruestung)
- WebUI: Hinweis "bei Leitung" in der Freigabestelle, Zaehler ohne diese, Quote je
  Leitung; Karte in der Organisationsansicht; i18n en/de
- Tests: LeadApprovalsTests (13), OrgAdministrationTests (+2)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/ClawdDotNet.Manager.Web/wwwroot/i18n/en.json

@@ -95,6 +95,11 @@
   "org.ceiling": "Tool ceiling",
   "org.ceilingHint": "What the unit may not have, a member cannot be granted. Lowering it removes tools from the members — after a confirmation.",
   "org.ceilingLimit": "Limit the tools of this unit",
+  "org.approvals": "Approvals by the lead",
+  "org.approvalsHint": "What the lead of this unit may approve for the agents below it, instead of you. One operation per line: Tool.operation, or Tool for all of it. Changes to agents always stay with you; a lead never approves its own calls. A sub-unit can grant no more than the units above it. Empty: you decide everything.",
+  "org.approvalsOperations": "Operations",
+  "org.approvalsPerDay": "Per day at most",
+  "org.approvalsHours": "Hours per approval",
   "org.ceilingInherited": "Limited from above to: {tools}",
   "org.settings": "Unit-wide values",
   "org.settingsHint": "Written into the agents after a preview. The unit keeps the value only as a default for new members — nothing overrides an agent at run time.",
@@ -608,6 +613,16 @@
   "staging.rejectButton": "Reject Call",
   "staging.rejected": "Call was rejected.",
   "staging.rejectFailed": "Rejection failed: {error}",
+  "staging.withLead": "Its lead {lead} may decide this until {until}, within the limits its unit grants. You can decide it first; after that it is yours alone.",
+  "staging.leadsTitle": "Approvals by leads",
+  "staging.leadsHint": "What leads approved instead of you in the last 30 days. A lead that approves everything does nothing but cost — look at its decisions.",
+  "staging.leadName": "Lead",
+  "staging.leadRouted": "Given",
+  "staging.leadApproved": "Approved",
+  "staging.leadRejected": "Rejected",
+  "staging.leadLapsed": "Left to you",
+  "staging.leadRate": "Approval rate",
+  "staging.leadAllApproved": "Everything approved — check whether this lead really looks.",
 
   "agentChats.title": "Agent Communication (A2A)",
   "agentChats.allAgents": "All Agents",