feat(tui): preselect suggested permission scope

Thread `suggestedScope` through the app-server permission approval
request and use it when constructing TUI approval requests. This
keeps the protocol backward compatible by defaulting the field to
`turn` when older clients omit it.

Add focused app-server and TUI coverage, plus a snapshot for the
session-suggested approval overlay so reviewers can see the
preselected session row.

codex-rs/app-server-protocol/schema/json/PermissionsRequestApprovalParams.json

@@ -39,6 +39,13 @@
       },
       "type": "object"
     },
+    "PermissionGrantScope": {
+      "enum": [
+        "turn",
+        "session"
+      ],
+      "type": "string"
+    },
     "RequestPermissionProfile": {
       "additionalProperties": false,
       "properties": {
@@ -79,6 +86,14 @@
         "null"
       ]
     },
+    "suggestedScope": {
+      "allOf": [
+        {
+          "$ref": "#/definitions/PermissionGrantScope"
+        }
+      ],
+      "default": "turn"
+    },
     "threadId": {
       "type": "string"
     },