feat: add approval step

Signed-off-by: kjuulh <contact@kjuulh.io>

CLAUDE.md

@@ -90,6 +90,7 @@ Follow the VSDD pipeline **religiously**. No shortcuts, no skipping phases.
 - Routes are organized by feature in `routes/` modules
 - All public API endpoints return proper HTTP status codes
 - Configuration via environment variables with sensible defaults
+- **Forms with conditional sections**: When a form has multiple sections toggled by a dropdown (e.g. policy type), inputs in hidden sections **must be disabled** so they are excluded from submission. Duplicate `name` attributes across sections cause axum's form deserializer to fail with "unsupported value". Always call the toggle function on page load to disable hidden inputs from the start.
 - **Tests live in separate files**, never inline in the main source file:
   - Unit tests for private functions: `#[cfg(test)] mod tests` in the same file (e.g., `forest_client.rs`)
   - Route/integration tests: `src/tests/` directory with files per feature area (e.g., `auth_tests.rs`, `platform_tests.rs`)