feat(seer): Gate Seer agent write requests behind user approval

[gricha]

What

A server-side gate so the Seer agent can't make mutating Sentry API calls without explicit user approval. Prototype, flag-gated (organizations:seer-agent-write-gate), default off.

How

• An agent request (X-Is-Agent header + trusted viewer-context auth) has its scopes masked to read-only — the same trick demo mode already uses. Reads pass; writes fail the normal scope check.
• A blocked write returns a structured 403 with a nonce + approval endpoint, and records a pending SeerAgentWriteGrant.
• The user approves via GET/POST /api/0/organizations/{org}/agent/approve/{nonce}/ from their own session. Once approved, the matching scope is unmasked and the agent's retry goes through.
• No new credential is ever minted — the gate only removes scopes, so there's nothing to leak.

Security (IDOR)

• Approval requires the authenticated user to be the grant's user; another org member can't approve or read it.
• Grant lookup is org-scoped; a nonce can't cross orgs.
• The agent carries the user's identity, so approval is blocked for viewer-context sessions — it can't self-approve.
• A grant can never exceed the user's own role scopes.

Scope / not yet

• Covers OrganizationPermission-derived endpoints. Project-scoped and non-ScopedPermission endpoints aren't gated yet (deferred).
• Seer-side changes (sending the header, showing the approval prompt, retrying) are a separate change.

Tests

19 tests: masking, challenge, grant unmask/expiry, flag-off no-op, plus the IDOR cases above. Planning artifacts under openspec/changes/add-agent-write-permission-gate/.