feat: login-context approval screen, one-tap Deny, stale-request expiry

- Approve now opens an in-app review screen showing app/user/IP/geo of the
  request (optional deep-link params: app, user, ip, geo, ts) before biometrics
- Add a Deny button on the approval screen (no biometric needed to reject)
- Reject requests older than 2 min via the ts param (replay safety net)
- README: context params table, new Features bullets, approve-context screenshot
- Bump to v1.2 (versionCode 3)

README.md

@@ -9,16 +9,34 @@ Authy push, with **no third-party cloud** in the loop.
 1. You log in via **Authentik**. A flow step fires an **ntfy** notification to your phone with two
    action buttons: **Approve** and **Deny**.
 2. The buttons are `homemfa://approve?token=…` / `homemfa://deny?token=…` deep links that open this app.
-3. **Approve** triggers a biometric prompt (fingerprint / face / device PIN). On success the app
-   POSTs `approve:<token>` to `ntfy.khodak.me/mfa-approve`; your Authentik flow is listening on that
-   topic and completes the login.
+3. **Approve** opens an in-app review screen showing *who is asking* (see context params below), then
+   triggers a biometric prompt (fingerprint / face / device PIN). On success the app POSTs
+   `approve:<token>` to `ntfy.khodak.me/mfa-approve`; your Authentik flow is listening on that topic and
+   completes the login. You can also **Deny** right from that screen.
 4. **Deny** POSTs `deny:<token>` to `mfa-deny` and blocks the login — no biometric needed to reject.
 
+### Optional context params
+
+The approve link may carry extra query params so you can see what you're approving before you do:
+
+| Param  | Shown as            | Example                |
+|--------|---------------------|------------------------|
+| `app`  | 🖥 application name | `app=Grafana`          |
+| `user` | 👤 username         | `user=amir`            |
+| `ip`   | 📍 source IP        | `ip=203.0.113.44`      |
+| `geo`  | appended to the IP  | `geo=Berlin, DE`       |
+| `ts`   | request timestamp (epoch ms) — used to **expire** stale prompts after 2 min | `ts=1750000000000` |
+
+All are optional and URL-encoded; with none present the app just shows a plain Approve / Deny prompt.
+
 The activity is `showWhenLocked` + `turnScreenOn`, so an approval works straight from the lock screen.
 
 ## Features
 
 - **Biometric gate** — `BIOMETRIC_STRONG` or device credential required to approve (deny is instant)
+- **Login context** — see the app, user, source IP and geo of the request before approving
+- **One-tap Deny** — reject a suspicious login straight from the approval screen, no biometric needed
+- **Stale-request expiry** — prompts older than 2 minutes can't be approved (replay safety net)
 - **Lock-screen ready** — wakes the screen and shows over the keyguard
 - **Self-hosted** — talks only to your own ntfy instance; no Firebase, no vendor cloud
 - **Zero stored secrets** — stateless; each request carries a one-time token
@@ -29,6 +47,8 @@ The activity is `showWhenLocked` + `turnScreenOn`, so an approval works straight
 <p align="center">
   <img src="docs/screenshots/setup.png" width="240" alt="Setup / ready screen">
   &nbsp;
+  <img src="docs/screenshots/approve-context.png" width="240" alt="Approval prompt with login context">
+  &nbsp;
   <img src="docs/screenshots/approved.png" width="240" alt="Login approved">
 </p>