feature: token-budget human-in-the-loop approval when budget exceeded

[evaline-ju]

Feature Description

Today on_exceed supports only deny (403 return) and observe (no enforcement). A middle ground would be to allow human approval to continued spend on a case-by-case basis without pre-raising limits for all sessions.

As a platform operator, I want agents to pause and request my approval when they exceed their session budget, so I can decide whether to let them continue rather than choosing between hard-killing them or silently logging overages.

This would be a follow-up to #708 and the suggestion #708 (comment)

Proposed Solution

• When a session exceeds its budget, the plugin calls a configured webhook and holds the request until an approve/deny decision comes back
• After approval, the session continues without re-asking for a configurable grace period
• Timeout or unreachable webhook falls back to a safe default (deny or allow, operator's choice)

Want to contribute?

• I would like to work on this issue.

Additional Context

Out of scope:

• Budget extension via webhook response
• Concurrency limiting on pending approvals per session
• Async approval queue

[evaline-ju]

Note: will plan to rename token-budget to session-budget for more generality