Show the requester who can approve a pending request, and let them nudge

[FrodeHus]

Area: Approvals

The problem

When a role needs approval, the person requesting it cannot find out who is supposed to approve.
This is a documented gap in PIM itself: the approver list is visible to administrators configuring
the role policy, not to the end user waiting on it. Requests therefore sit — approvers are in another
time zone, not in their inbox, or simply unaware — and the common outcome reported by teams rolling
PIM out is a stalled activation during an incident, followed by the rollout being rolled back.

Elevate knows a role needs approval but not who approves it:

• RolePolicy (macos/Sources/ElevateCore/Models/Roles.swift) carries requiresApproval: Bool and
  nothing about approver identities.
• PolicyNotes renders "approval" and "An approver must accept the request before the role becomes
  active." — true, but it leaves the user with no next step.
• The approval providers (EntraApprovalProvider, AzureApprovalProvider, GroupApprovalProvider)
  serve the approver's queue. There is nothing for the requester's side of the same request.

So the panel shows "Pending approval" indefinitely and the user's only recourse is to ask around in
chat.

What you would like Elevate to do

Read the role's approval settings and surface the approvers to the person waiting.

• Extend RolePolicy with the approver stage: the users and groups that can approve, resolved to
  display names (expanding approver groups where readable).
• Before activating, show them in the activation sheet — "Approvers: Alice Nguyen, Platform On-call
  (4 members)" — so the user knows up front whether anyone is reachable.
• On a pending request, show the same list with how long it has been waiting, and a Nudge action:
  copy an approval link and a ready-made message, or send via the user's mail client / Teams, rate
  limited so it cannot be used to spam.
• Expose it in the CLI too: elevate status and elevate activate --wait should name who is being
  waited on rather than only "pending approval".
• Where the directory does not let the account read the approver list, say that explicitly instead of
  showing an empty list.

Alternatives considered

• Documenting "ask your admin who the approvers are" in docs/approvals.md. Does not help at 02:00.
• A generic "an approval is pending" notification with no detail — which is what the portal already
  does and what people complain about.

Anything else

• Graph exposes the approval stages on the role management policy rules
  (Approval_EndUser_Assignment), so the data is reachable with scopes Elevate already holds for
  policy reading; worth confirming for Azure resource roles and PIM for Groups separately.
• A natural follow-up: an escalation timer ("no answer in 15 minutes → surface the backup approver"),
  and a quiet-hours / delegate switch on the approver side. Separate issues.