fix(approvals): replace the opposite rule when one is set - #2149

Why

With a require_approval rule on a tool, every call shows a card offering "Always allow this tool". Tapping it saved an always_allow rule next to the existing one. Two rules on the same tool resolve to ask, so the card came back on every later call, and the rule list showed both effects for one tool.

What changed

A tool, site, connector or category now has one rule effect per user and space. Setting one effect, from the card's "Always allow" button or from approvalRules.set, deletes the opposite rule in the same transaction, through one shared helper. The delete ignores case, as rule matching does (compared literally, so _ in a tool name is not a wildcard), and an advisory lock on the match keeps two opposite saves at once from both landing. No migration: existing pairs are fixed the next time either rule is set.

How tested

A new journey test against Postgres sets require_approval (in mixed case), answers a card with "Always", checks that the next call runs without a card and that the list holds only always_allow, then sets require_approval again and checks the list holds only that. A second saves opposite rules on several matches at once and checks each keeps one, and a third checks that replacing tool_a leaves a rule on toolXa alone. Each fails without the change. The answer unit test now checks the delete. Lint and typecheck pass; the unit suite passes except the backup script tests, which fail the same way on main on macOS.