feat: approval decisions, tenant scoping, error paths with tests

- POST /api/approvals/{id}/decision (approve starts continuation flow
  with task facts; reject closes; 404/409/422 guards)
- Tenant scoping: list filters + cross-tenant reads 404
- Error mapping covered: LFX down 503, LFX drift 502, corrupt flow 422
- 34 tests green

backend/app/flows/schemas.py

@@ -98,3 +98,15 @@ class FlowImportRequest(BaseModel):
 class FlowImportRead(BaseModel):
     definition: FlowDefinitionRead
     version: FlowVersionRead
+
+
+class DecisionRequest(BaseModel):
+    decision: str = Field(pattern="^(approve|reject)$")
+    approver: str = Field(default="", max_length=200)
+    note: str = Field(default="", max_length=2000)
+    callback_base_url: str | None = None
+
+
+class DecisionRead(BaseModel):
+    task: ApprovalRead
+    continuation_run: RunRead | None