fix(api,policy): restore Server.approval + bump tfhe to v1.6.4 (#234)

Two more 4f14931-pattern orphans surfaced after the merge of
kms-nonce-bind-2026-04-28: server.go lost the `approval` field that
handlers_approval.go references, and pkg/policy still references the
canonical-tfhe surface that wasn't in luxfi/threshold v1.6.0.

Three fixes, all small:

  pkg/api/server.go
    - Add `approval *ApprovalRegistry` field. SetApproval / handler call
      sites unchanged. Optional — when nil, /v1/approval/* returns 503.
    - Add `tieredWallets wallet.Registry` field, mirror of the same
      pattern (handlers_wallet.go references s.tieredWallets via
      SetTieredWalletRegistry / tieredWalletsRegistry()).

  go.mod / go.sum
    - Bump github.com/luxfi/threshold v1.6.0 → v1.6.4. v1.6.4 ships the
      committee.go surface (FHECiphertext, FHEThresholdShare, KeyShare,
      ShareAggregator, PartialDecrypter, StatusOK, ...) that
      pkg/policy/fhe_threshold_decryptor.go canonical-imports.
    - Refresh edwards25519 sums (re-tagged upstream).

  pkg/policy/fhe_threshold_decryptor_test.go
    - TestMain sets LUX_ALLOW_FAKE_TFHE_FOR_TESTING_ONLY=1. v1.6.4 added
      a guardUnsafe() panic on every fake-threshold entry point so the
      real-threshold cutover is unmissable in production. Stub party
      tests are by definition the fake path; opt-in is correct.

Verify:
  go build ./pkg/api/... ./pkg/policy/...    PASS
  go vet  ./pkg/api/... ./pkg/policy/...     PASS
  CGO_ENABLED=1 go test -tags json1 ./pkg/api/ ./pkg/policy/ -short -race
                                             PASS (4.0s + 1.4s)

Out of scope (#222 stage 1, separate orphan):
  cc/attest/sev.go and pkg/attestation/composite.go reference
  go-sev-guest and luxfi/lattice/v7/types — those need their own fix.

Refs: #208 (airgap), #227 (buildHSMSignerConfig), #234.

Author: Hanzo AI

go.mod

@@ -34,7 +34,7 @@ require (
 	github.com/luxfi/hsm v1.1.2
 	github.com/luxfi/log v1.4.1
 	github.com/luxfi/metric v1.5.1
-	github.com/luxfi/threshold v1.6.0
+	github.com/luxfi/threshold v1.6.4
 	github.com/luxfi/zap v0.2.0
 	github.com/minio/minio-go/v7 v7.0.99
 	github.com/mitchellh/mapstructure v1.5.0

go.sum

@@ -370,8 +370,8 @@ github.com/luxfi/crypto v1.17.45 h1:uGK0y4+aLipE/M0YIQ5hcsWv0ZG0E4cPv03a94K/eLE=
 github.com/luxfi/crypto v1.17.45/go.mod h1:GnAkhQ7HNs3X0Tzx5nOONS3kl0yRmWHbDcRO5ffILsg=
 github.com/luxfi/database v1.17.44 h1:hfiTls7sqbweW+o4iaZqB8P997paC+vpgWmhN6v5MJ0=
 github.com/luxfi/database v1.17.44/go.mod h1:6Ey5y3I0WNLHbxIlIdFqUuKfBg+b0fAgTA8FgRgQ8zg=
-github.com/luxfi/edwards25519 v0.1.0 h1:zuSrBtgV4NUiJ8dzzJiLU4o+A0AHGnztRLUvZ24mAYk=
-github.com/luxfi/edwards25519 v0.1.0/go.mod h1:tFuuyXvI+xqUoHz9pwC+kqsALCGHSO1SymL1NjCOmFM=
+github.com/luxfi/edwards25519 v0.1.0 h1:YPoT831TZMslvNyy/KuTtpHi4BGZWgpwak06RCaYLzo=
+github.com/luxfi/edwards25519 v0.1.0/go.mod h1:MBoV+bPEz1tSMADPMSUaYdZ+agY3syG8B6z7RmJBH0A=
 github.com/luxfi/fhe v1.7.7 h1:RP26i3CxvNy2y/3LKiJPgd9uR5MrlG/MvQnv5rkQFhk=
 github.com/luxfi/fhe v1.7.7/go.mod h1:FHfGNgKL5ZLcnKVKFVNLDJOBbQyQm5DGpVrMnY8ASJo=
 github.com/luxfi/geth v1.16.79 h1:MtP8ZUuSVZDjmZDa1kTJCl0PpG8+wGbQft652GO6a3A=
@@ -396,8 +396,8 @@ github.com/luxfi/mock v0.1.1 h1:0HEtIjg1J6CWz+IUyP6rsGqNWTcmxjFnSQIhaDuARwY=
 github.com/luxfi/mock v0.1.1/go.mod h1:jo35akl3Vtd8LbzDts8VJ0jmSVycrd1/eBi6g6t5hKU=
 github.com/luxfi/sampler v1.0.0 h1:k8Sf6otW83w4pQp0jXLA+g3J/joB7w7SqXQsWmNTOV0=
 github.com/luxfi/sampler v1.0.0/go.mod h1:f96/ozlj9vFfZj+akLtrHn4VpulQahwB+MQQhpeIekk=
-github.com/luxfi/threshold v1.6.0 h1:pq/n1iYowws+CXe/+slJodjPlJ152hFF94luHp2E82c=
-github.com/luxfi/threshold v1.6.0/go.mod h1:XWSfWM3n/tVggluh/LH7is4vYL85zmyMHCqfz2qrYVU=
+github.com/luxfi/threshold v1.6.4 h1:SDExhsRJovCccvCQwWK5TUpa5u4upXGEnEDW/XGB7/k=
+github.com/luxfi/threshold v1.6.4/go.mod h1:jNBQbeBMmxz9xYSWIer2kOMqq49mYIszSZwTdk1odc0=
 github.com/luxfi/utils v1.1.4 h1:8OY0jXCkpp6OotN1Y++6DATJkvtEwzq2k0p56imJlAk=
 github.com/luxfi/utils v1.1.4/go.mod h1:c3yz1RjzrB+cs5GZm+q1T3/2cCKElO9vxm9yRRtgSEM=
 github.com/luxfi/zap v0.2.0 h1:RzvOkp3EoN5UCkpnqfObHLM1sEHy7YcxXKuermhE/VA=