feat(peers): full trust-store UI — accept, reject, revoke, re-authorize

- /api/peers/reject forwards to the auth service's new /internal/reject
  (pending request denied + audited; peer stays on the no-op path).
- TrustedServices panel now has three sections: Requested (Accept/Reject),
  Accepted (Revoke), and Revoked (Re-authorize), with timestamps.
- The old pending 'Ignore' button mapped to revoke, which was the wrong
  operation for a never-approved request.

spec.yaml

@@ -546,3 +546,26 @@ paths:
           description: Missing service or fingerprint
         '502':
           description: Failed to reach the shared auth service
+
+  /api/peers/reject:
+    post:
+      summary: Reject a pending peer authorization request
+      tags: ["security"]
+      description: >
+        Denies a first-contact authorization request without authorizing it.
+        The auth service drops the request from the pending list and audits
+        the decision; the peer stays on the no-op path (a later contact simply
+        re-records a fresh pending request).
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/PeerAction'
+      responses:
+        '200':
+          description: Pending request rejected
+        '400':
+          description: Missing service or fingerprint
+        '502':
+          description: Failed to reach the shared auth service