feat(canvas): Agent 审批 - 节点直接生成时自动关闭同节点的待审批任务

用户在画布节点上直接提交生成后，同画布 Agent 对该节点等待中的 generate_media 审批关闭为 superseded_by_node，Agent 带着「用户已手动提交」的结果继续，不重复提交、不扣费。审批卡片识别目标节点正在生成时禁用「同意执行」并提示原因。

backend/internal/repository/cloud_agent.go

@@ -149,6 +149,17 @@ func (r *Repository) CloudAgentForActiveTask(userID, taskID string) (*model.Clou
 	})
 	return &run, err
 }
+
+// CloudAgentIDsWaitingApprovalForCanvas lists the caller's runs paused on an
+// approval for one canvas. Callers reload each run before mutating it.
+func (r *Repository) CloudAgentIDsWaitingApprovalForCanvas(userID, canvasID string) ([]string, error) {
+	var ids []string
+	err := r.db.Model(&model.CloudAgentExecution{}).
+		Where("user_id = ? AND canvas_id = ? AND status = ?", userID, canvasID, "waiting_approval").
+		Order("id").Limit(20).Pluck("id", &ids).Error
+	return ids, err
+}
+
 func (r *Repository) CloudAgentRoots() ([]model.Task, error) {
 	var tasks []model.Task
 	err := r.db.Where("operation = ? AND id NOT IN (SELECT id FROM cloud_agent_executions)", "cloud_agent").Order("created_at").Limit(50).Find(&tasks).Error