[makeitfutureDev]

Company members currently require manual operator approval. This adds Admin UI → Users → Auto-approval with an opt-in list of exact email domains. Matching provider identities gain Approved access before engine selection; Admin privileges, channel restrictions and admission limits remain unchanged.

Slack uses a fresh human profile lookup (users:read.email required). Google Chat/Teams use authenticated provider sender email when present. Manual revocation records an opt-out, and policy removal retains existing approvals. Existing known Slack users can be previewed in bounded batches and explicitly approved; apply re-fetches identities and checks the current policy and opt-outs under the store write lock. Policy changes and automatic approvals are audited.

Validation at candidate 78f9b98afe1fff91ab1e3b0a00e185c1ac2a0c76:

• Clean dependency installation using the unchanged lockfile.
• Full coverage suite: 4,033 tests, 3,998 passed, 35 skipped, zero failures; overall coverage 94.20% lines / 86.62% branches / 90.23% functions.
• Dedicated new authorization coverage: 98.54% lines / 84.52% branches / 94.44% functions.
• Real Chromium UI/API acceptance passed: persistence, nonmutating preview, explicit apply without Admin, manual revocation, invalid-domain rejection, 390px layout and no page errors. Disposable runtime and fake provider identities only.
• Static checks, secret scan, security coverage and DCO passed.
• Production dependency audit BLOCKED: 8 existing advisories (3 high, 5 moderate); package.json and package-lock.json are unchanged by this PR.

Release gates still pending:

• Live provider inbound acceptance in a disposable deployment, as specified in TEST-PLAN.md; simulated provider tests are not a live pass.
• Required private QA registry entries: requesting user's personal connection is unavailable. No other identity was substituted.
• Passing CI and exact-candidate release confirmation after all required gates are satisfied.

This draft is not a release-ready candidate. Main and the served checkout have not been modified.

Maintainer decision: explicitly instructed to deploy to main and test later. Live acceptance and private QA recording are deferred, not recorded as passes. Node 22.13 and Node 24 CI test jobs passed. CI hygiene failed on the existing dependency advisories; documentation validation failed on the existing missing list_email_accounts control reference. These outstanding checks remain recorded for follow-up.