frontend(admin): global-config toggle for require_different_approver (follow-up to #1005) #1501

Context

PR #1500 (closes #1005) ships full backend enforcement of the 4-eyes approval mode: when global_config.require_different_approver is true, the creator of a scheduled execution cannot approve it themselves. Migration 000092 defaults the column to false so current admin UI behavior is unchanged.

Ask

Add an admin-only toggle in the global-config settings page (whichever admin page holds the other GlobalConfig fields) that flips require_different_approver on/off.

Scope

• One boolean toggle in the admin settings UI wired to SaveGlobalConfig.
• Optimistic-UI checkbox pattern used by other config toggles; on error, revert and toast.
• Read the current value on page load from the same endpoint that returns other GlobalConfig fields.
• Frontend test: toggle click -> API call -> state update.

Non-goals

• Per-user or per-account overrides (global-only per Add optional 4-eyes / different-approver mode for purchase approvals (segregation of duties) #1005 design).
• Approval-flow UI changes (backend already returns the correct 403 + admin-directed message; the existing error-render path shows it verbatim).

Trigger to close

• UI element visible to admins on the global-config page.
• Toggling it round-trips through SaveGlobalConfig and is reflected in the DB.
• E2E test covers the round-trip.