feat(peers): full trust-store UI — accept, reject, revoke, re-authorize

- /api/peers/reject forwards to the auth service's new /internal/reject
  (pending request denied + audited; peer stays on the no-op path).
- TrustedServices panel now has three sections: Requested (Accept/Reject),
  Accepted (Revoke), and Revoked (Re-authorize), with timestamps.
- The old pending 'Ignore' button mapped to revoke, which was the wrong
  operation for a never-approved request.

src/main.go

@@ -113,6 +113,7 @@ func main() {
 	mux.HandleFunc("/api/peers/attestation", peersHandler.Attestation)
 	mux.HandleFunc("/api/peers/approve", peersHandler.Approve)
 	mux.HandleFunc("/api/peers/revoke", peersHandler.Revoke)
+	mux.HandleFunc("/api/peers/reject", peersHandler.Reject)
 
 	frontendDir, err := fs.Sub(embeddedFrontend, "frontend/dist")
 	if err != nil {