feat(web): create_automation HITL approval card in chat

Closes the create loop in chat: the agent describes user intent → the
drafter sub-LLM produces an AutomationCreate JSON → this card surfaces
a structured preview → approve persists; reject cancels. Edits flow
through chat refinement (re-call with a refined intent), not in-card,
so the card stays simple and the multi-turn checkpointer carries the
context.

Tool UI (components/tool-ui/automation/):
- create-automation.tsx — entry dispatcher + ApprovalCard chrome
  (pending/processing/complete/rejected via useHitlPhase) + SavedCard
  (links to the detail page) + InvalidCard (lists drafter validation
  issues) + ErrorCard (verbatim message). Rejection result is hidden
  because the approval card itself shows the rejected phase inline.
- automation-draft-preview.tsx — structured preview body: name +
  description + goal, triggers (humanised cron + tz + static-input
  keys), plan steps (step_id → action), and a collapsible raw JSON
  for power users.

Wiring:
- components/tool-ui/index.ts — re-export.
- features/chat-messages/timeline/tool-registry/registry.ts —
  register create_automation → CreateAutomationToolUI (dynamic import,
  same pattern as other connector tools).
- contracts/enums/toolIcons.tsx — Workflow icon + "Create automation"
  display name so fallback chrome (and timeline headers) are honest.

Shared util:
- lib/automations/describe-cron.ts — lifted from the route slice's
  lib/ folder since both the dashboard slice and the new approval card
  now render schedule descriptions. Slice imports updated; the now-
  empty slice lib/ folder is gone.

Backend prompt fragments:
- main_agent/system_prompt/.../create_automation/description.md and
  the tool's docstring no longer promise in-card edits. They make the
  refinement path explicit: if the user wants changes after seeing the
  draft, they reply in chat and the agent calls the tool again with a
  refined intent.

v1 deliberately excludes:
- In-card edit form / right-side edit panel — defer until we see real
  demand. The chat refinement loop covers the common case.
- approve_always / persistent allow rules — automations are a single
  artifact, not a repeated mutation, so the "trust this kind of call"
  affordance doesn't apply.

surfsense_web/app/dashboard/[search_space_id]/automations/[automation_id]/components/trigger-card.tsx

@@ -6,8 +6,8 @@ import { updateTriggerMutationAtom } from "@/atoms/automations/automations-mutat
 import { Button } from "@/components/ui/button";
 import { Switch } from "@/components/ui/switch";
 import type { Trigger } from "@/contracts/types/automation.types";
+import { describeCron } from "@/lib/automations/describe-cron";
 import { formatRelativeDate } from "@/lib/format-date";
-import { describeCron } from "../../lib/describe-cron";
 import { DeleteTriggerDialog } from "./delete-trigger-dialog";
 
 interface TriggerCardProps {

surfsense_web/app/dashboard/[search_space_id]/automations/components/automation-triggers-summary.tsx

@@ -1,7 +1,7 @@
 "use client";
 import { CalendarClock, Pause } from "lucide-react";
 import type { Trigger } from "@/contracts/types/automation.types";
-import { describeCron } from "../lib/describe-cron";
+import { describeCron } from "@/lib/automations/describe-cron";
 
 interface AutomationTriggersSummaryProps {
 	triggers: Trigger[];

surfsense_web/app/dashboard/[search_space_id]/automations/lib/describe-cron.ts

@@ -1,66 +0,0 @@
-/**
- * Minimal cron describer for the 5-field patterns the SurfSense drafter LLM
- * actually produces (daily, weekdays, weekly, monthly, hourly). Falls back
- * to the raw expression when unrecognized so the user still sees something
- * honest instead of a guess.
- *
- * Lives in the automations slice because it's a UI display concern with no
- * consumers outside it. If reuse grows, lift to ``lib/cron-describe.ts``.
- */
-
-const DAY_NAMES = ["Sun", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat"];
-
-export function describeCron(cron: string): string {
-	const parts = cron.trim().split(/\s+/);
-	if (parts.length !== 5) return cron;
-
-	const [minute, hour, dom, month, dow] = parts;
-
-	// Daily at H:MM ("0 9 * * *")
-	if (month === "*" && dom === "*" && dow === "*" && /^\d+$/.test(minute) && /^\d+$/.test(hour)) {
-		return `Daily at ${formatTime(hour, minute)}`;
-	}
-
-	// Weekdays at H:MM ("0 9 * * 1-5")
-	if (month === "*" && dom === "*" && dow === "1-5" && /^\d+$/.test(minute) && /^\d+$/.test(hour)) {
-		return `Mon–Fri at ${formatTime(hour, minute)}`;
-	}
-
-	// Specific weekday(s) ("0 9 * * 1" or "0 9 * * 1,3,5")
-	if (
-		month === "*" &&
-		dom === "*" &&
-		/^\d+$/.test(minute) &&
-		/^\d+$/.test(hour) &&
-		/^[\d,]+$/.test(dow)
-	) {
-		const days = dow
-			.split(",")
-			.map((d) => DAY_NAMES[Number(d) % 7])
-			.filter(Boolean)
-			.join(", ");
-		if (days) return `${days} at ${formatTime(hour, minute)}`;
-	}
-
-	// Monthly on day N ("0 9 1 * *")
-	if (
-		month === "*" &&
-		dow === "*" &&
-		/^\d+$/.test(dom) &&
-		/^\d+$/.test(hour) &&
-		/^\d+$/.test(minute)
-	) {
-		return `Day ${dom} of each month at ${formatTime(hour, minute)}`;
-	}
-
-	// Hourly ("0 * * * *")
-	if (month === "*" && dom === "*" && dow === "*" && hour === "*" && /^\d+$/.test(minute)) {
-		return minute === "0" ? "Every hour" : `Every hour at :${minute.padStart(2, "0")}`;
-	}
-
-	return cron;
-}
-
-function formatTime(hour: string, minute: string): string {
-	return `${hour.padStart(2, "0")}:${minute.padStart(2, "0")}`;
-}