Merge nucleic/humble-feather-yak-edwe into dev

NucleicRemote/Shared/ApproveFromActivityIntent.swift

@@ -54,9 +54,20 @@ struct ApproveFromActivityIntent: AppIntent {
             store.route(to: SessionID(rawValue: sessionID))
             throw IntentError.needsAppConfirmation
         }
-        // Best-effort bring-up; `respondToApproval` queues briefly on a dropped link (§3.1). A lost
-        // first-responder race is de-duped host-side (§3.4), so we never surface an error for it.
-        _ = await store.awaitLiveConnection()
+        // Cloud lock-screen approvals are opt-in (SyncedSettings.resolveApprovalsViaCloud). When
+        // off, don't push the decision over Nucleic's relay — hand off to the app to resolve it
+        // locally (the foreground app can use the local network). Read the flag from the local
+        // cache the sync layer keeps current, so a cold background launch decides without a host.
+        guard SyncedSettings.resolveApprovalsViaCloud() else {
+            store.route(to: SessionID(rawValue: sessionID))
+            throw IntentError.resolveInApp
+        }
+        // On: resolve inline over the Nucleic Edge. Dial relay-first with a longer budget — a
+        // backgrounded/locked intent can't rely on LAN, and the relay handshake (mint token +
+        // WebSocket upgrade + Noise) needs more time than a direct dial. `respondToApproval`
+        // queues briefly on a dropped link (§3.1); a lost first-responder race is de-duped
+        // host-side (§3.4), so we never surface an error for it.
+        _ = await store.awaitLiveConnection(timeout: 12, preferRelay: true)
         let decision: Decision = allow ? .allow(updatedInput: nil) : .deny(reason: nil)
         store.respondToApproval(
             id: ApprovalID(rawValue: approvalID),