Testimonial approval workflow #13

Right now every testimonial is visible immediately. Users need to approve testimonials before they appear in widgets.

• Add is_approved and is_featured booleans to the testimonial entity
• POST /api/v1/testimonials/{id}/approve and /feature toggle endpoints
• Widgets only show approved testimonials by default
• Testimonials from form submissions start as unapproved
• Dashboard gets approve/reject buttons on the testimonial list
• Bulk approve would be handy but can come later