fix(web-ui): restore inline ACP file approval actions

[wgqqqqq]

What changed

This PR restores inline ACP approval controls for file operation tool cards in FlowChat.

Specifically, it updates FileOperationToolCard so ACP-triggered confirmation states for Write, Edit, and Delete render as compact header actions on the right side of the card, instead of leaving the session waiting without an obvious approval entry point.

Why

ACP file permission requests were reaching the frontend and correctly marking the tool card as pending_confirmation, but file operation cards did not expose confirm/reject controls in that state.

As a result, ACP-backed sessions could get stuck waiting for approval while the UI only showed the tool card and a waiting state, with no visible way for the user to continue.

User impact

Users can now approve or reject ACP file operations directly from the file operation tool card header.

This makes ACP file confirmations behave consistently with other compact approval surfaces in FlowChat and avoids the "stuck waiting for permission with no visible action" failure mode.

Root cause

Write, Edit, and Delete tool calls are rendered through FileOperationToolCard, but that card did not implement the same inline approval affordance used by other tool cards.

The ACP permission event path was already working, but the file card UI was missing the last-mile interaction layer.

Implementation notes

• Wire onConfirm and onReject into FileOperationToolCard
• Detect ACP confirmation state from requiresConfirmation and userConfirmed
• Render compact right-side header actions for confirm/reject
• Support the same approval affordance for Delete cards
• Add lightweight styling for the inline confirmation actions
• Preserve existing expand/click behavior for normal file previews

Validation

• pnpm run lint:web
• pnpm run type-check:web
• pnpm --dir src/web-ui run test:run