fix(federation): narrow trust-guard query to inbound rows only

The pre-existing trust-guard's query filtered peer_approval_requests by
origin only. After Task 3 added outbound rows to the same table, the
guard started matching the user's own queued outbound row on retry,
returning 'rejected' with a misleading 'admin must resolve pending
approval' copy instead of the intended 'admin_required'. The variable
name (pendingInbound) and comment block already described the intent
as inbound-only — the query just didn't match. Adding direction='inbound'
to the where clause restores the intended behavior.

packages/server/src/utils/federationPeering.ts

@@ -198,10 +198,20 @@ export async function ensurePeered(
   // The legitimate approval flow (routes/federation.ts /approval-requests/:id/
   // approve) does NOT call ensurePeered — it deletes the approval-request first
   // and does its own fetch — so this guard does not block legitimate approvals.
+  //
+  // direction='inbound' filter: the table is bidirectional as of the outbound
+  // peering gate (Task 3); outbound rows live in the same table and must NOT
+  // trigger this guard. The outbound gate below (`if (!existing)` block) is
+  // responsible for outbound row state.
   const pendingInbound = db
     .select({ id: schema.peerApprovalRequests.id })
     .from(schema.peerApprovalRequests)
-    .where(eq(schema.peerApprovalRequests.origin, normalized))
+    .where(
+      and(
+        eq(schema.peerApprovalRequests.origin, normalized),
+        eq(schema.peerApprovalRequests.direction, 'inbound'),
+      ),
+    )
     .get();
 
   if (pendingInbound) {