A pure read says the oldest approved wait: how long the longest-waiting approved, unlanded pull has waited since its approval #6422

Flow work for #5930 ("oldest approved wait" among the flow vitals; a clog is declared when it passes 24 h). #3885 sat approved for 5.5 days and no number said so.

Done when:

• [ ] A new src/flow/oldest_approved.ts exports readOldestApproved(db, now, publicOnly): { pull, repo, hours } for the open, unmerged pull whose latest approval is oldest, or null when none is approved. An approval followed by a newer changes-requested verdict does not count.
• [ ] It uses the same publicOnly rule as readVitals in src/flow/vitals.ts, and it is one SQL read.
• [ ] Tests: the oldest of three approved pulls is named; a landed pull is ignored; a re-review asking for changes drops a pull out; publicOnly hides private repositories; none approved gives null.
• [ ] Nothing reads it yet. Showing it is the follow-up issue.

Files: src/flow/oldest_approved.ts, a new test/flow-oldest-approved.test.ts.