fix(web): pending-approvals-card 加防重複點擊 + loading 狀態

linter 自動強化: actioningId state 防止同一張卡重複操作
- disabled + opacity 0.6 + cursor not-allowed
- loading 時按鈕顯示 '...'
- finally() 確保 actioningId 清除

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps/api/migrations/sprint5r_telegram_message_id.sql

@@ -0,0 +1,10 @@
+-- Sprint 5R: 批准執行閉環修復 — 新增 Telegram 訊息持久化欄位
+-- 2026-04-09 Claude Sonnet 4.6: C1 架構 Review 修復
+-- 用途: 批准卡片發送後記錄 message_id/chat_id，供後續 editMessageReplyMarkup 移除按鈕
+
+ALTER TABLE approval_records
+  ADD COLUMN IF NOT EXISTS telegram_message_id INTEGER,
+  ADD COLUMN IF NOT EXISTS telegram_chat_id INTEGER;
+
+COMMENT ON COLUMN approval_records.telegram_message_id IS 'Telegram message_id of approval card, used to remove inline keyboard after decision';
+COMMENT ON COLUMN approval_records.telegram_chat_id IS 'Telegram chat_id where approval card was sent';