BeforeTool-hook + kort-vy (strukturerade godkännanden) + release på master-push

Feature: strukturerade verktygsgodkännanden
- shared: protokoll för approval (daemon:approval, server:approval[-resolved],
  web:approval-decision, server:approval-decision)
- daemon: hook-läge ('agent-helm hook' — samma binär), lokal 127.0.0.1-endpoint
  som hooken POST:ar till, long-poll tills beslut; graceful default (allow) när
  ingen UI; timeout-fallback; skickar AGENT_HELM_HOOK_PORT till agentens env
- server: routar daemon:approval -> prenumeranter, beslut -> daemon + döljer kort
- web: reaktiv approvals-lista + kort-overlay (Tillåt/Neka), mobilanpassad

CI:
- release.yaml triggar nu även på master-push -> rullande 'latest'-release
  (versionerade releaser kvar på v*-taggar); install.sh hämtar 'latest'

Docs: hook-konfig (gemini settings.json) + hook-env i .env.example + DEPLOY.md.
Säkerhet: hook-endpoint binder endast 127.0.0.1; inga hemligheter i repot.

Verifierat lokalt: hook->daemon->server->kort->beslut->hook ger {"decision":"allow"};
alla paket typecheckar; web bygger.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitea/workflows/release.yaml

@@ -6,12 +6,13 @@ name: release-client
 # dem som assets på en Gitea-release.
 on:
   push:
-    tags: ["v*"]
+    branches: [master, main]      # varje master-push -> rullande 'latest'-release
+    tags: ["v*"]                  # vX.Y.Z -> versionerad release
   workflow_dispatch:
     inputs:
       tag:
-        description: "Release-tag (t.ex. v0.1.0)"
-        required: true
+        description: "Release-tag (lämna tom för 'latest')"
+        required: false
 
 jobs:
   build-release:
@@ -23,7 +24,12 @@ jobs:
       - name: Bestäm tag
         id: t
         run: |
-          if [ -n "${{ inputs.tag }}" ]; then echo "tag=${{ inputs.tag }}" >> "$GITHUB_OUTPUT"; else echo "tag=${GITHUB_REF_NAME}" >> "$GITHUB_OUTPUT"; fi
+          case "$GITHUB_REF" in
+            refs/tags/*) T="$GITHUB_REF_NAME" ;;
+            *) T="${{ inputs.tag }}"; [ -z "$T" ] && T="latest" ;;
+          esac
+          echo "tag=$T" >> "$GITHUB_OUTPUT"
+          echo "bygger release: $T"
 
       - name: Bundla daemonen
         run: |