[DX] Clearer permission_prompt status + action hints in API response

[OneStepAt4time]

Context

Zeus killed sessions after seeing permission_prompt status, thinking it was an error. CC was just waiting for file write approval.

Improvements

1. API responses for permission_prompt should include actionable hint: "CC is waiting for file write approval. Send POST /v1/sessions/:id/approve to continue"
2. Consider auto-approve for sessions where CC is configured with bypassPermissions — if CC itself would bypass, Aegis should too
3. Telegram notification for permission_prompt should include approve/reject buttons more prominently

From Zeus field feedback, 2026-03-22.