Packshot approval state in the Plugin API

Packshot listings in the Plugin API now report each packshot's approval state, so integrations can check which packshot unblocks photo sessions for a product without trial submissions.

Every packshot returned by GET /packshots and GET /products/{id_or_ref} now includes two new fields: voting (pending, accepted, or rejected) and voting_at (the time of the decision). Until now, the only way to find out whether a product had an approved packshot was to submit a photo session and handle the packshot_not_approved error — your integration can now read the approval state directly from the catalog listings.

Packshots registered directly via POST /packshots are approved automatically, and the listings reflect that immediately. The API contract was also clarified in two places: the HMAC secret rotation response now documents the grace_window_hours field (the dual-signing window, currently 48 hours), and the external_metadata field on session submissions documents its 4096-byte size limit.