fix(tess): wire command approvals through gateway

apps/gateway/src/commands/command-authorization.service.ts

@@ -55,17 +55,20 @@ export class CommandAuthorizationService {
   }
 
   async createApproval(
-    command: string,
+    command: CommandDef,
     payload: SlashCommandPayload,
     actorId: string,
-  ): Promise<CommandApproval> {
+  ): Promise<CommandApproval | null> {
+    const role = await this.resolveRole(actorId);
+    if (!role || command.scope !== 'admin' || !this.hasScope(role, command.scope)) return null;
+
     const approvalId = randomUUID();
     const expiresAt = new Date(Date.now() + 5 * 60_000).toISOString();
     const approval: CommandApproval = {
       approvalId,
-      actionDigest: this.actionDigest(command, payload),
+      actionDigest: this.actionDigest(command.name, payload),
       actorId,
-      command,
+      command: command.name,
       expiresAt,
     };
     await this.redis.set(this.key(approvalId), JSON.stringify(approval), 'EX', '300');