sec(api): delayed approval via emailed token never validates the token when purchase_delay_hours > 0 #586

Summary

Found in the review of PR #584 (closes #564). approveViaToken (internal/api/handler_purchases.go ~658-707) never validates the emailed approval token when purchase_delay_hours > 0: it goes straight to approveWithDelay and only ApproveExecution (the later immediate path) validates the token. Reviewer probe with a delay of 1h, a contact-email session and the token WRONG: HTTP 200 "scheduled". A caller holding a session that is a contact-email match can therefore schedule an approval without the token whenever a delay is configured.

Acceptance

Call validateApprovalToken before approveWithDelay (so invalid is 403 and expired is 410, as on the immediate path after #584), with a regression test through HandleRequest with a configured delay and a wrong token that fails before and passes after, plus the valid-token delayed case still scheduling. Related: #564, #584, #532.