#3045 Show expired approval gates as expired, with a Cancel action in the dashboard

Split from #2518 (its second ask).

Problem

Once a manual_approval gate passes its timeout, the run is left out of swamp workflow approvals and the dashboard Approvals view, while the run list still shows it suspended with a step waiting_approval. Nothing says the gate expired, and the dashboard has no Cancel action anywhere, so the operator has to know to run swamp workflow cancel with --run and --server from a terminal. Runs under Awaiting resume have the same gap: the only button is Resume, which is not acceptable for an old mutating run.

Proposed

1. workflowApprovals (src/libswamp/workflows/approvals.ts) returns an expired list beside approvals: run, workflow, step, suspendedAt, timeout. swamp workflow approvals shows it as a separate section with the cancel command in log mode and as an expired array in json mode.
2. handleWorkflowApprovals (src/serve/handlers/workflow_handlers.ts) currently filters only the approvals key by per-workflow read access before sending the whole data object. It must apply the same filterByResources check and redactParentRun to the expired list, with a test that an expired gate of an unreadable workflow is withheld.
3. Dashboard Approvals view (packages/dashboard/src/views/Approvals.tsx): an Expired panel with a Cancel button, and a Cancel button beside Resume on Awaiting resume rows. Both send workflow.cancel with the run id and workflow after a confirm. The sidebar pending count keeps counting only open gates.
4. Update the expired-gate paragraph in design/primitives/workflows.md and the swamp skill workflow references.

Notes

The server side of cancel already works for these runs: a suspended run with an expired gate is cancelled by run id through serve (swamp-club#2514). This issue is only about making the state visible and the action reachable.