perf(executor): recover approved steps on engine restart

When the engine restarts mid-step, an in-progress step may have already
passed plan + code review but not yet been flipped to done by the agent's
next task_update call. Previously, the next executor pass re-entered the
step and replayed both reviews — measured at 5-20 min of pure waste per
restart (observed in FN-2215 Step 1 and FN-2207 Step 6).

recoverApprovedStepsOnResume scans the task log for any in-progress step
whose most recent "code review Step N: APPROVE" entry is newer than its
most recent "Step N → pending" transition, and marks those steps done
before execute() runs. Safely skips steps that were reset after approval
(e.g. by a workflow revision) or only received REVISE verdicts.

Called from both the engine-restart path (resumeOrphaned) and the
unpause path, matching the two places the task log shows as vulnerable
to this race.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

packages/dashboard/src/server.ts

@@ -379,8 +379,17 @@ export function createServer(store: TaskStore, options?: ServerOptions): ReturnT
   // Only applied to the webhook route
   app.use("/api/github/webhooks", express.raw({ type: "application/json" }));
 
-  // Standard JSON parsing for all other routes
-  app.use(express.json());
+  // Standard JSON parsing for all other routes.
+  // Preserve the raw payload buffer so signed endpoints (for example
+  // /api/routines/:id/webhook and settings sync proxying) can verify HMAC
+  // signatures and forward exact request bytes.
+  app.use(express.json({
+    verify: (req, _res, buf) => {
+      if (buf.length > 0) {
+        (req as express.Request & { rawBody?: Buffer }).rawBody = Buffer.from(buf);
+      }
+    },
+  }));
 
   // Daemon mode: bearer token authentication middleware
   // Auth is enabled when daemon option is provided OR FUSION_DAEMON_TOKEN env var is set