ux: approve HITL is single-click with no confirm and no undo #271

Summary

Approving a schedule is a single-click, irreversible-in-UI action — while rejecting has a full confirmation dialog with a reason input. Approve is the human gate of the HITL flow (approve → scheduler auto-publishes to Threads), so it deserves at least symmetric friction.

Evidence

• web/src/routes/admin/schedules/+page.svelte:413-425 — handleApprove() runs immediately: optimistic status → approveSchedule() → toast. No confirmation, no undo.
• Reject flow (:428-449) opens ConfirmDialog with a reason input — the asymmetric sibling.
• grep cancelSchedule|unapprove across web/src = 0 hits → an accidental approval cannot be pulled back from the UI at all.

Impact

• One mis-click converts a draft into a real Threads publish with no in-product recovery path. Data-loss-adjacent for a self-hosted social tool.

Fix

• Two-stage approve: first click arms the button ("Confirm?"), second click within ~3s commits; or reuse the existing ConfirmDialog with explicit copy ("Will auto-publish to Threads when due").
• Out of scope for UI-only fix: a backend cancel/unapprove endpoint for approved/pending schedules (needs API design; track separately).

Acceptance criteria

• Single mis-click can no longer approve a schedule.
• Copy states the publish consequence explicitly.
• Reject flow unchanged.

Source: Titen UX audit 2026-09-20 (finding H2).