Add per-account approval settings for apps (#42047)

## What changed

- Add `apps.<app_id>.links.<link_id>` configuration for overriding
  `approvals_reviewer` and `default_tools_approval_mode` per connected account.
- Expose link settings through the app-server protocol and generated JSON and
  TypeScript schemas.

## Testing

- Extend `config/read` coverage for populated, empty, and absent `links`
  sections.

GitOrigin-RevId: 43004d2722439060fdadc5e5cd9ed3108774ecaf

codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.v2.schemas.json

@@ -490,6 +490,17 @@
           "default": true,
           "type": "boolean"
         },
+        "links": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/AppLinksConfig"
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "Per-account approval settings keyed by link ID."
+        },
         "open_world_enabled": {
           "type": [
             "boolean",
@@ -618,6 +629,36 @@
       ],
       "type": "object"
     },
+    "AppLinkConfig": {
+      "description": "Approval settings for a connected account within an app.",
+      "properties": {
+        "approvals_reviewer": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/ApprovalsReviewer"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
+        "default_tools_approval_mode": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/AppToolApproval"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        }
+      },
+      "type": "object"
+    },
+    "AppLinksConfig": {
+      "description": "Account settings for a single app.",
+      "type": "object"
+    },
     "AppListUpdatedNotification": {
       "$schema": "http://json-schema.org/draft-07/schema#",
       "description": "EXPERIMENTAL - notification emitted when the app list changes.",