Approval queue

Every post is approved before it goes live — nothing publishes un-approved.

Approve → scheduled posts auto-fire via the worker; publish-now posts go to Meta immediately. Every transition is audited.