feat(ask-owner): owner-only fail-safe decisions in the nest log (#41)

Message gains approval_phrase; ask_owner is postable by the owner and the
owner-facing service roles (Quill/Sentry) and bypasses Jev tagging with
tagged_by header. An ordinary crow's ask_owner header is dropped and the
message tags as it otherwise would. nestRecord (now a Server method)
carries approval_phrase and a computed resolved: approved only on an
owner reply whose trimmed lowercased text equals the phrase via refers_to;
anything else, including an ask unanswered past Server.askTimeout
(10 minutes by default, the same fail-safe window as list approvals), is
not a yes.

nestlog.go

@@ -24,7 +24,11 @@ type Message struct {
 	Mode       string `json:"mode,omitempty"` // solo | conspiracy | split (requests only, Epic C)
 	ModeTagged string `json:"mode_tagged_by,omitempty"`
 	Invited    int    `json:"invited,omitempty"`
-	Timestamp  string `json:"ts"`
+	// ApprovalPhrase is the exact phrase that resolves an ask_owner (#41):
+	// only an owner reply equal to it is a yes. Anything else, including
+	// silence and timeout, is not.
+	ApprovalPhrase string `json:"approval_phrase,omitempty"`
+	Timestamp      string `json:"ts"`
 }
 
 func (m Message) MsgID() string { return fmt.Sprintf("%s-%d", m.NestID, m.ID) }