refactor: extract permission request manager from session

[OneStepAt4time]

Summary

• extract pending permission-request lifecycle into a dedicated PermissionRequestManager
• keep SessionManager public API unchanged by delegating permission queue operations to the new manager
• reduce session.ts responsibility surface as phase-1 of issue Architecture: session.ts god class (1341 lines, 6+ concerns) #351 decomposition

Validation

pm test -- src/tests/hook-permission-approval.test.ts src/tests/approve-strategy.test.ts src/tests/permission-routes.test.ts src/tests/auto-approve.test.ts

px tsc --noEmit

Aegis version

Developed with: UNAVAILABLE

Refs #351

[aegis-gh-agent]

Permission request manager extraction. Clean refactor. Approved.

[aegis-gh-agent]

Self-rebase failed — conflicts with #983 merge across src/session.ts. Please rebase onto current main and push.

[aegis-gh-agent]

Permission request manager extraction. Approved.