fix(federation): broadcast peering_subscription_changed on terminal state

Live verification caught a stale-UI bug: when admin denial / approval
fanout / janitor expiry cascaded subscriber rows away, only the
peering_notification_received WS event fired (which only refetches
the notification list). The user's pending-subscriptions section
stayed stale until manual refresh.

Each terminal-state path now also fires peering_subscription_changed
to affected users so their pending list refreshes alongside the new
notification. Fixed in:
- onPeerActivated.fanoutOutboundSubscribers (approval path)
- handleOutboundDeny (admin denial)
- cleanupExpiredApprovalRequests (janitor expiry; also adds the
  notification-received broadcast that was previously deferred to
  next-page-load only)

packages/server/src/utils/federationPeerActivation.ts

@@ -246,6 +246,11 @@ async function fanoutOutboundSubscribers(peerId: string): Promise<void> {
       type: 'peering_notification_received' as const,
       kind: 'approved',
     });
+    // The subscriber row is about to cascade-delete; tell the user's UI to
+    // refetch its pending list so the now-stale row disappears.
+    connectionManager.sendToUser(sub.userId, {
+      type: 'peering_subscription_changed' as const,
+    });
   }
 
   // Cascade-deletes subscriber rows via onDelete: 'cascade'.