fix: Fetch remote before merge/push in initiative approval

approveInitiative was merging and pushing with a stale local
defaultBranch, causing "rejected (fetch first)" when origin/main
had advanced since the last project sync. Now fetches remote and
fast-forwards the target branch before merging.

apps/server/git/branch-manager.ts

@@ -75,4 +75,17 @@ export interface BranchManager {
    * Uses `git merge-tree --write-tree` (git 2.38+).
    */
   checkMergeability(repoPath: string, sourceBranch: string, targetBranch: string): Promise<MergeabilityResult>;
+
+  /**
+   * Fetch all refs from a remote.
+   * Defaults to 'origin' if no remote specified.
+   */
+  fetchRemote(repoPath: string, remote?: string): Promise<void>;
+
+  /**
+   * Fast-forward a local branch to match its remote-tracking counterpart.
+   * No-op if already up to date. Throws if fast-forward is not possible
+   * (i.e. the branches have diverged).
+   */
+  fastForwardBranch(repoPath: string, branch: string, remote?: string): Promise<void>;
 }