Default web approval action

[benidk]

Description

Following this issue

Adds a new admin parameter, "Default web approval action", to configure which action is presented as the primary (one-click) button in the in-browser web approval dialog (OutOfBandAuth), among:

• Authorize & remember (single target) — default, matches current behavior
• Authorize for all targets & remember
• Authorize this time only

AI Usage

Choose the level of AI involvement for this PR.

• Fully vibe coded
• AI-designed, AI-coded, manually checked
• Human-designed, AI-coded
• Human-designed, human-coded (includes AI autocompletions and boilerplate gen)

_{This is not to block AI contributions but rather to speed up PR review (saves time on trying to deduce the logic behind AI hallucinations).}