- /api/peers/reject forwards to the auth service's new /internal/reject (pending request denied + audited; peer stays on the no-op path). - TrustedServices panel now has three sections: Requested (Accept/Reject), Accepted (Revoke), and Revoked (Re-authorize), with timestamps. - The old pending 'Ignore' button mapped to revoke, which was the wrong operation for a never-approved request.