新增: 审批超时可配置 + ScriptNode 命令白/黑名单

- 审批超时: Settings 下拉选择(不限时/5/15/30/60min),默认 15min
- getApprovalTimeoutMs() 从 KV 读取,startApprovalTimer 动态取值
- ScriptNode: 黑名单 > 白名单策略,从环境变量读取
- Settings 加命令执行安全面板(白/黑名单文本框)
- i18n 中英文案 + 搜索索引补全

src/i18n/en/settings.ts

@@ -125,6 +125,15 @@ export default {
     labelLogLevel: 'Log level',
     descLogLevel: 'Verbosity of workflow logs',
 
+    // ===== Approval timeout =====
+    labelApprovalTimeout: 'Approval timeout',
+    descApprovalTimeout: 'Auto-reject threshold when user does not respond to an approval prompt (only affects approvals started after the change)',
+    approvalTimeoutUnlimited: 'No limit',
+    approvalTimeout5m: '5 minutes',
+    approvalTimeout15m: '15 minutes (default)',
+    approvalTimeout30m: '30 minutes',
+    approvalTimeout60m: '60 minutes',
+
     labelShowTokenUsage: 'Show token usage',
     descShowTokenUsage: 'Show token consumption of each reply in conversations',
 
@@ -159,6 +168,17 @@ export default {
     allowedDirsAddFail: 'Failed to add authorized directory',
     allowedDirsRemoveFail: 'Failed to remove authorized directory',
 
+    // ===== ScriptNode command execution safety =====
+    panelScriptSafety: '🛡️ Command Execution Safety',
+    descScriptSafety: 'Configure ScriptNode command whitelist/blacklist. Command name is the first token (e.g. `rm -rf /` -> `rm`), compared trimmed and lowercase. Blacklist takes precedence over whitelist.',
+    labelScriptWhitelist: 'Command whitelist',
+    descScriptWhitelist: 'Comma-separated command names (e.g. git,npm,cargo); empty = unrestricted. When non-empty, only listed commands are allowed.',
+    labelScriptBlacklist: 'Command blacklist',
+    descScriptBlacklist: 'Comma-separated command names (e.g. rm,format,shutdown); any match rejects execution.',
+    placeholderScriptWhitelist: 'Leave empty for no restriction, or: git,npm,cargo',
+    placeholderScriptBlacklist: 'Leave empty for no blacklist, or: rm,format',
+    noteScriptSafety: 'Note: backend ScriptNode currently reads DF_SCRIPT_WHITELIST / DF_SCRIPT_BLACKLIST env vars (same comma-separated semantics). This UI only persists on the frontend; wiring to backend is planned for a later release.',
+
     // ===== Knowledge base panel =====
     panelKnowledge: '📚 Knowledge base',
     labelAutoExtract: 'Auto-distill knowledge',