feat(notifications): direct BRD + Plane links in approve ping (ORCH-017)

notify_approve_requested now embeds two HTML <a> links into the single
notifying approve-gate message: a Gitea branch-view link to 01-brd.md and a
Plane issue browser link. Adds ORCH_PLANE_WEB_URL (external Plane web URL,
fallback to plane_api_url) with a loopback-guard that omits the Plane link
when the resolved base is localhost/empty (no broken localhost URLs in prod).

Each link is built independently and omitted on missing data; the message and
the "flip to Approved" call to action are always sent as exactly one ping. The
shared send_telegram helper is left untouched (min blast radius for the
self-hosting prod container). Dynamic labels are html.escaped; parse_mode=HTML
preserved. QG registry / stages / approve handler unchanged.

Docs updated in-PR: CHANGELOG, .env.example, INFRA env map.
Tests: test_notify_approve_links.py, test_analysis_approve_flow_links.py.

Refs: ORCH-017
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

src/config.py

@@ -4,6 +4,11 @@ from pydantic_settings import BaseSettings
 class Settings(BaseSettings):
     # Plane
     plane_api_url: str = "http://localhost:8091"
+    # ORCH-017: external (browser) web URL of Plane for clickable issue links in
+    # notifications, e.g. https://plane.example.org. Falls back to plane_api_url,
+    # but a loopback fallback (localhost/127.0.0.1) is treated as "no web URL" and
+    # the Plane link is omitted (see notifications._build_plane_issue_link).
+    plane_web_url: str = ""
     plane_api_token: str = ""
     plane_workspace_slug: str = ""
     plane_webhook_secret: str = ""