fix(federation): broadcast peering_subscription_changed on terminal state

Live verification caught a stale-UI bug: when admin denial / approval
fanout / janitor expiry cascaded subscriber rows away, only the
peering_notification_received WS event fired (which only refetches
the notification list). The user's pending-subscriptions section
stayed stale until manual refresh.

Each terminal-state path now also fires peering_subscription_changed
to affected users so their pending list refreshes alongside the new
notification. Fixed in:
- onPeerActivated.fanoutOutboundSubscribers (approval path)
- handleOutboundDeny (admin denial)
- cleanupExpiredApprovalRequests (janitor expiry; also adds the
  notification-received broadcast that was previously deferred to
  next-page-load only)

packages/server/src/routes/federation.ts

@@ -775,6 +775,10 @@ async function handleOutboundDeny(
       type: 'peering_notification_received' as const,
       kind: 'denied',
     });
+    // Subscriber row is about to cascade-delete; refresh the user's pending list.
+    connectionManager.sendToUser(sub.userId, {
+      type: 'peering_subscription_changed' as const,
+    });
   }
 
   // Cascade-delete clears subscribers via onDelete: 'cascade'.