Approve a document's pending classification

Request body for POST /documents/{doc_id}/classification/approve (ENG-647).

Approving with no sensitivity confirms the document's current effective label and clears the review flag (pending_review/pending_unsearchable → active). Supplying sensitivity re-labels the document on approval, subject to the same anti-escalation as the PATCH endpoint (a LOWER needs org:manage). reason is recorded on the classification audit event.

Current classification of a document.

Built explicitly (not from_attributes) because document_id maps to Document.id and detected_sensitivity comes from the active version.