fix(approvals): friendly case title (no 32-hex business_subject leaks)

Buyer-script audit showed queue row titles falling through to raw
case-key hex when business_subject was empty / set to the case key
itself. New friendlyCaseTitle helper:
- prefer display_name if not machine-shaped
- prefer business_subject if not machine-shaped
- else 'Case in <step name>'
- else 'Untitled case'

isMachineId catches 20+-char hex AND process_<timestamp> pattern.

src/scenes/Approvals.tsx

@@ -24,6 +24,21 @@ function ageLabel(item: WorkItem): string {
   return `${Math.floor(days / 30)} mo`;
 }
 
+function isMachineId(s?: string | null): boolean {
+  if (!s) return true;
+  return /^[a-f0-9]{20,}$/i.test(s) || /^process_\d{10,}$/.test(s);
+}
+
+function friendlyCaseTitle(item: WorkItem): string {
+  const display = (item as any).display_name as string | undefined;
+  const subject = item.business_subject;
+  if (display && !isMachineId(display)) return display;
+  if (subject && !isMachineId(subject)) return subject;
+  const stepName = item.active_step_display_name || item.next_action;
+  if (stepName) return `Case in ${stepName}`;
+  return "Untitled case";
+}
+
 export default function Approvals() {
   const userEmail = useApp((s) => s.userEmail);
   const actor = useApp((s) => s.actor);
@@ -145,7 +160,7 @@ export default function Approvals() {
                   onClick={() => setActiveKey(it.transaction_id)}
                 >
                   <div className="approvals-row-head">
-                    <span className="approvals-row-title">{(it as any).display_name || it.business_subject || "Untitled case"}</span>
+                    <span className="approvals-row-title">{friendlyCaseTitle(it)}</span>
                     <span className="approvals-row-age">{it.age_label}</span>
                   </div>
                   <div className="approvals-row-meta">