Add per-account approval settings for apps (#42047)

## What changed

- Add `apps.<app_id>.links.<link_id>` configuration for overriding
  `approvals_reviewer` and `default_tools_approval_mode` per connected account.
- Expose link settings through the app-server protocol and generated JSON and
  TypeScript schemas.

## Testing

- Extend `config/read` coverage for populated, empty, and absent `links`
  sections.

GitOrigin-RevId: 43004d2722439060fdadc5e5cd9ed3108774ecaf

codex-rs/app-server-protocol/src/protocol/v2/config.rs

@@ -209,6 +209,24 @@ pub struct AppToolsConfig {
     pub tools: HashMap<String, AppToolConfig>,
 }
 
+/// Approval settings for a connected account within an app.
+#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, JsonSchema, TS)]
+#[serde(rename_all = "snake_case")]
+#[ts(export_to = "v2/")]
+pub struct AppLinkConfig {
+    pub approvals_reviewer: Option<ApprovalsReviewer>,
+    pub default_tools_approval_mode: Option<AppToolApproval>,
+}
+
+/// Account settings for a single app.
+#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, JsonSchema, TS)]
+#[serde(rename_all = "snake_case")]
+#[ts(export_to = "v2/")]
+pub struct AppLinksConfig {
+    #[serde(default, flatten)]
+    pub links: HashMap<String, AppLinkConfig>,
+}
+
 #[derive(Serialize, Deserialize, Debug, Clone, PartialEq, JsonSchema, TS)]
 #[serde(rename_all = "snake_case")]
 #[ts(export_to = "v2/")]
@@ -221,6 +239,8 @@ pub struct AppConfig {
     pub default_tools_approval_mode: Option<AppToolApproval>,
     pub default_tools_enabled: Option<bool>,
     pub tools: Option<AppToolsConfig>,
+    /// Per-account approval settings keyed by link ID.
+    pub links: Option<AppLinksConfig>,
 }
 
 #[derive(Serialize, Deserialize, Debug, Clone, PartialEq, JsonSchema, TS)]