feat(peers): full trust-store UI — accept, reject, revoke, re-authorize

- /api/peers/reject forwards to the auth service's new /internal/reject
  (pending request denied + audited; peer stays on the no-op path).
- TrustedServices panel now has three sections: Requested (Accept/Reject),
  Accepted (Revoke), and Revoked (Re-authorize), with timestamps.
- The old pending 'Ignore' button mapped to revoke, which was the wrong
  operation for a never-approved request.

src/lib/authmgmt/client.go

@@ -204,6 +204,13 @@ func (c *Client) Revoke(ctx context.Context, service, fingerprint string) error
 		authzRequest{Service: service, Fingerprint: fingerprint}, nil)
 }
 
+// Reject denies a pending first-contact request: the request is dropped and
+// audited; the peer stays on the no-op path until the owner approves it.
+func (c *Client) Reject(ctx context.Context, service, fingerprint string) error {
+	return c.do(ctx, http.MethodPost, "/internal/reject",
+		authzRequest{Service: service, Fingerprint: fingerprint}, nil)
+}
+
 func (c *Client) do(ctx context.Context, method, path string, body, out any) error {
 	var payload []byte
 	if body != nil {