✨(approvals): make dangerous command approval timeout configurable

[acsezen]

Summary

• Read approvals.timeout from config.yaml instead of hardcoding 60 seconds
• Applies to both the fallback CLI prompt (tools/approval.py) and the TUI prompt_toolkit callback (hermes_cli/callbacks.py)
• Default remains 60s when unset — no behavior change for existing users

Motivation

When running complex agent workflows with delegation subtasks, the 60s timeout is often too short — the prompt expires and the command is denied before the user can respond. The clarify callback already reads its timeout from config, so this follows the same pattern.

approvals:
  mode: smart
  timeout: 120

Test plan

• All 95 existing approval tests pass (test_approval.py + test_cli_approval_ui.py)
• Manual: set approvals.timeout: 10 and verify the countdown matches
• Manual: remove approvals.timeout and verify 60s default

Closes #3765

[teknium1]

Merged via #3886. Cherry-picked with authorship preserved, plus added timeout: 60 to DEFAULT_CONFIG for discoverability. All 116 approval tests pass. Thanks @acsezen!