feat: add approval step

Signed-off-by: kjuulh <contact@kjuulh.io>

interface/proto/forest/v1/apps.proto

@@ -0,0 +1,109 @@
+syntax = "proto3";
+
+package forest.v1;
+
+import "google/protobuf/timestamp.proto";
+
+service AppService {
+  // App lifecycle
+  rpc CreateApp(CreateAppRequest) returns (CreateAppResponse);
+  rpc GetApp(GetAppRequest) returns (GetAppResponse);
+  rpc ListApps(ListAppsRequest) returns (ListAppsResponse);
+  rpc DeleteApp(DeleteAppRequest) returns (DeleteAppResponse);
+  rpc SuspendApp(SuspendAppRequest) returns (SuspendAppResponse);
+
+  // App tokens
+  rpc CreateAppToken(CreateAppTokenRequest) returns (CreateAppTokenResponse);
+  rpc ListAppTokens(ListAppTokensRequest) returns (ListAppTokensResponse);
+  rpc RevokeAppToken(RevokeAppTokenRequest) returns (RevokeAppTokenResponse);
+}
+
+// ─── Core types ──────────────────────────────────────────────────────
+
+message App {
+  string app_id = 1;
+  string organisation_id = 2;
+  string name = 3;
+  string description = 4;
+  repeated string permissions = 5;
+  bool suspended = 6;
+  google.protobuf.Timestamp created_at = 7;
+}
+
+message AppToken {
+  string token_id = 1;
+  string name = 2;
+  google.protobuf.Timestamp expires_at = 3;
+  google.protobuf.Timestamp last_used = 4;
+  bool revoked = 5;
+  google.protobuf.Timestamp created_at = 6;
+}
+
+// ─── App lifecycle ───────────────────────────────────────────────────
+
+message CreateAppRequest {
+  string organisation_id = 1;
+  string name = 2;
+  string description = 3;
+  repeated string permissions = 4;
+}
+
+message CreateAppResponse {
+  App app = 1;
+}
+
+message GetAppRequest {
+  string app_id = 1;
+}
+
+message GetAppResponse {
+  App app = 1;
+}
+
+message ListAppsRequest {
+  string organisation_id = 1;
+}
+
+message ListAppsResponse {
+  repeated App apps = 1;
+}
+
+message DeleteAppRequest {
+  string app_id = 1;
+}
+
+message DeleteAppResponse {}
+
+message SuspendAppRequest {
+  string app_id = 1;
+  bool suspended = 2;
+}
+
+message SuspendAppResponse {}
+
+// ─── App tokens ──────────────────────────────────────────────────────
+
+message CreateAppTokenRequest {
+  string app_id = 1;
+  string name = 2;
+  int64 expires_in_seconds = 3; // 0 = no expiry
+}
+
+message CreateAppTokenResponse {
+  AppToken token = 1;
+  string raw_token = 2; // only returned on creation
+}
+
+message ListAppTokensRequest {
+  string app_id = 1;
+}
+
+message ListAppTokensResponse {
+  repeated AppToken tokens = 1;
+}
+
+message RevokeAppTokenRequest {
+  string token_id = 1;
+}
+
+message RevokeAppTokenResponse {}