feat(studio): localise Settings sidebar + add inline help docs + Approvals doc

Three operator-UX gaps closed:

  - Settings dialog's six-category sidebar (General / Appearance /
    System AI / Integrations / Security / Maintenance) was
    hardcoded English; now flows through AppLocalizations
    ("Allgemein" / "Darstellung" / "System-KI" / "Integrationen" /
    "Sicherheit" / "Wartung"). Same for the per-panel title +
    description.
  - Per-channel daemon-action labels ('enable autostart' /
    'disable autostart' / 'daemon restart' etc.) and the
    OK / Failed result line in the toast also moved to l10n,
    so the system-action feedback reads as one language.
  - New 'Approvals' doc bundle (en + de) under assets/docs/,
    registered as a fifth doc card on Welcome plus exposed via
    the new public  helper. The
    Approvals, Audit and Doctor app-bars grow a Help icon button
    next to Refresh that opens the matching doc in the existing
    bottom-sheet reader — no extra screen, no learning curve.

Studio bumped to 0.67.0; editor path-override pulls in 0.20.1
(flow-list row polish).

Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>

lib/l10n/app_en.arb

@@ -30,6 +30,9 @@
   "welcomeDocAuditBlurb": "How the hash chain works and why WORM-1 is enough for KRITIS.",
   "welcomeDocFlowsTitle": "Flow composition",
   "welcomeDocFlowsBlurb": "YAML basics, templating reference, the extract→summarize example.",
+  "welcomeDocApprovalsTitle": "Approvals",
+  "welcomeDocApprovalsBlurb": "Human-in-the-loop checkpoints — when to use them, how the audit log records them.",
+  "helpTooltip": "Help",
   "welcomeDocClose": "Close",
   "welcomeDocFailedToLoad": "Could not load documentation: {error}",
   "@welcomeDocFailedToLoad": {
@@ -1452,6 +1455,41 @@
     }
   },
   "doctorPathStudioErrors": "Studio errors",
+  "settingsCategoryGeneral": "General",
+  "settingsCategoryAppearance": "Appearance",
+  "settingsCategoryAi": "System AI",
+  "settingsCategoryIntegrations": "Integrations",
+  "settingsCategorySecurity": "Security",
+  "settingsCategoryMaintenance": "Maintenance",
+  "settingsAiPanelTitle": "System AI",
+  "settingsAiPanelBody": "Operator-managed LLM endpoint used by Studio for the AI helpers (system-ai-edit, install-suggest, doctor-summary). No flow ever calls this; modules speak to their own LLM.",
+  "settingsIntegrationsPanelTitle": "Integrations",
+  "settingsIntegrationsPanelBody": "External tool servers the hub federates capabilities from. MCP servers expose tool-shaped endpoints; n8n endpoints expose hosted workflows.",
+  "settingsSecurityPanelTitle": "Security & credentials",
+  "settingsSecurityPanelBody": "Tokens the hub holds on the operator's behalf. Stored in ~/.fai/ with mode 0600; never sent in telemetry.",
+  "settingsMaintenancePanelTitle": "Maintenance",
+  "settingsMaintenancePanelBody": "Destructive operations gated behind explicit confirm dialogs. Use when re-pilot-testing or debugging.",
+  "tooltipMoveUp": "Move up",
+  "tooltipMoveDown": "Move down",
+  "tooltipRemove": "Remove",
+  "daemonActionEnableAutostart": "enable autostart",
+  "daemonActionDisableAutostart": "disable autostart",
+  "daemonActionRestart": "daemon restart",
+  "daemonActionStart": "daemon start",
+  "daemonActionStop": "daemon stop",
+  "daemonActionStatus": "daemon status",
+  "daemonActionResultOk": "OK · {label}",
+  "@daemonActionResultOk": {
+    "placeholders": {
+      "label": {"type": "String"}
+    }
+  },
+  "daemonActionResultFailed": "Failed · {label}",
+  "@daemonActionResultFailed": {
+    "placeholders": {
+      "label": {"type": "String"}
+    }
+  },
   "addSourceTitle": "Add module source",
   "addSourceIntro": "`{capability}` is not in the public store. Point the hub at a `.fai` bundle URL or a local bundle path; the hub downloads, verifies (sha256 + signature) and installs it.",
   "@addSourceIntro": {