Add permission-aware follow-up flow with interactive resolution

When follow-up agent detects permission-blocked items ("ручное
применение", "permission denied", etc.), they become pending_actions
instead of auto-created tasks. User chooses per item:
  1. Rerun with --dangerously-skip-permissions
  2. Create manual task
  3. Skip

core/followup.py:
  _is_permission_blocked() — regex detection of 9 permission patterns
  generate_followups() returns {created, pending_actions}
  resolve_pending_action() — handles rerun/manual_task/skip

agents/runner.py:
  _run_claude(allow_write=True) adds --dangerously-skip-permissions
  run_agent/run_pipeline pass allow_write through

CLI: kin approve --followup — interactive 1/2/3 prompt per blocked item
API: POST /approve returns {needs_decision, pending_actions}
     POST /resolve resolves individual actions
Frontend: pending actions shown as cards with 3 buttons in approve modal

136 tests, all passing. Frontend builds clean.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

web/frontend/src/api.ts

@@ -92,6 +92,13 @@ export interface TaskFull extends Task {
   related_decisions: Decision[]
 }
 
+export interface PendingAction {
+  type: string
+  description: string
+  original_item: Record<string, unknown>
+  options: string[]
+}
+
 export interface CostEntry {
   project_id: string
   project_name: string
@@ -113,7 +120,9 @@ export const api = {
   createTask: (data: { project_id: string; title: string; priority?: number; route_type?: string }) =>
     post<Task>('/tasks', data),
   approveTask: (id: string, data?: { decision_title?: string; decision_description?: string; decision_type?: string; create_followups?: boolean }) =>
-    post<{ status: string; followup_tasks: Task[] }>(`/tasks/${id}/approve`, data || {}),
+    post<{ status: string; followup_tasks: Task[]; needs_decision: boolean; pending_actions: PendingAction[] }>(`/tasks/${id}/approve`, data || {}),
+  resolveAction: (id: string, action: PendingAction, choice: string) =>
+    post<{ choice: string; result: unknown }>(`/tasks/${id}/resolve`, { action, choice }),
   rejectTask: (id: string, reason: string) =>
     post<{ status: string }>(`/tasks/${id}/reject`, { reason }),
   runTask: (id: string) =>