feat: drafts UI — /drafts review page + batch generate button

/drafts page: список черновиков по статусам (pending/approved/rejected)
  Одобрить + выбрать время → scheduled_post в календарь
  Редактировать текст inline, отклонить, удалить
Header: ссылка 'Черновики' (FileText иконка)
ChannelView: кнопка 'Авто ×N' для batch-генерации (async)
ChannelEdit AI-стиль: секция авто-черновиков (toggle + count + time)
API routes: /api/drafts, /api/drafts/[id]/{approve,reject}
  /api/channels/[channelId]/drafts/generate

app/api/drafts/[id]/approve/route.js

@@ -0,0 +1,17 @@
+import { NextResponse } from 'next/server';
+import { requireUser } from '@/lib/session';
+
+const ENGINE_URL    = process.env.ENGINE_URL    || 'http://127.0.0.1:3030';
+const ENGINE_SECRET = process.env.ENGINE_SECRET || '';
+
+export async function POST(req, { params }) {
+  const user = await requireUser();
+  if (!user) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+  const body = await req.json().catch(() => ({}));
+  const res = await fetch(`${ENGINE_URL}/api/drafts/${params.id}/approve`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', 'x-internal-secret': ENGINE_SECRET, 'x-user-id': String(user.id) },
+    body: JSON.stringify(body),
+  });
+  return NextResponse.json(await res.json());
+}

app/api/drafts/[id]/reject/route.js

@@ -0,0 +1,15 @@
+import { NextResponse } from 'next/server';
+import { requireUser } from '@/lib/session';
+
+const ENGINE_URL    = process.env.ENGINE_URL    || 'http://127.0.0.1:3030';
+const ENGINE_SECRET = process.env.ENGINE_SECRET || '';
+
+export async function POST(req, { params }) {
+  const user = await requireUser();
+  if (!user) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+  const res = await fetch(`${ENGINE_URL}/api/drafts/${params.id}/reject`, {
+    method: 'POST',
+    headers: { 'x-internal-secret': ENGINE_SECRET, 'x-user-id': String(user.id) },
+  });
+  return NextResponse.json(await res.json());
+}

app/api/drafts/[id]/route.js

@@ -0,0 +1,30 @@
+import { NextResponse } from 'next/server';
+import { requireUser } from '@/lib/session';
+
+const ENGINE_URL    = process.env.ENGINE_URL    || 'http://127.0.0.1:3030';
+const ENGINE_SECRET = process.env.ENGINE_SECRET || '';
+
+function h(userId) {
+  return { 'x-internal-secret': ENGINE_SECRET, 'x-user-id': String(userId) };
+}
+
+// PATCH /api/drafts/:id
+export async function PATCH(req, { params }) {
+  const user = await requireUser();
+  if (!user) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+  const body = await req.json();
+  const res = await fetch(`${ENGINE_URL}/api/drafts/${params.id}`, {
+    method: 'PATCH',
+    headers: { ...h(user.id), 'Content-Type': 'application/json' },
+    body: JSON.stringify(body),
+  });
+  return NextResponse.json(await res.json());
+}
+
+// DELETE /api/drafts/:id
+export async function DELETE(req, { params }) {
+  const user = await requireUser();
+  if (!user) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+  const res = await fetch(`${ENGINE_URL}/api/drafts/${params.id}`, { method: 'DELETE', headers: h(user.id) });
+  return NextResponse.json(await res.json());
+}