#1019 Approval status endpoint is unauthenticated and cross-tenant; approver IP taken from X-Forwarded-For first hop

Found during #1010. (1) GET /api/v1/gateway/approvals/<approval_id>/status has no auth and queries public.human_approvals by approval_id OR approval_key with no tenant filter, so anyone who knows or guesses an approval_key (often a readable string) learns status and responded_at of another tenant's approval. (2) _get_source_ip trusts the first X-Forwarded-For entry; it is recorded as approved_by='email_link:<ip>' and approval_tokens.consumed_by_ip, so the audit trail value is caller-controlled unless nginx overwrites the header. EARS proposal: the status route shall require either a valid signed token for that approval or an authenticated caller in the approval's tenant; the source IP used for audit shall come from the trusted proxy hop only.