fix: address v2 stack review findings

apps/docs/docs/management/assistant.mdx

@@ -49,7 +49,10 @@ summary of accessible Homarr resources. Live status is fetched only when needed.
 
 ## Permissions and privacy
 
-- Read-only actions can run automatically. Changes require approval.
+- Read-only actions can run automatically. Changes require approval by default.
+- **Automatic approvals** can be enabled for one conversation. While enabled, protected changes, submitted form details,
+  and affirmative answers run without another approval click. It turns off when you switch conversations; Homarr
+  permissions still apply to every action.
 - Homarr permissions apply to every tool call and mentioned item.
 - API keys and custom headers are encrypted and never returned to the browser.
 - Conversations are stored per user and can be exported or deleted.

apps/docs/docs/management/custom-widgets/custom-jsx.mdx

@@ -61,8 +61,8 @@ than one variable quantifier are rejected.
 - `ActionButton` and `ToggleSwitch` run actions only when the widget is mounted outside edit mode. A toggle needs both
   enabled and disabled request parameters and rolls back its visual state if the action fails.
 - `RefreshButton` renders a compact, accessible icon control that invalidates the client's load-query cache so active load
-  queries can refetch; it does not execute a request itself. It is disabled when the widget has no active item or preview
-  session, or while the board is in edit mode.
+  queries can refetch; it does not execute a request itself. It is disabled for anonymous viewers, when the widget has no
+  active item or preview session, or while the board is in edit mode.
 - `Icon`/`TablerIcon` resolves installed safe icons.
 
 Always include responsive loading, empty, error, and success states. Runtime failures remain inside the widget tile.

apps/docs/docs/management/custom-widgets/requests-and-security.mdx

@@ -60,8 +60,8 @@ Queries default to view permission and actions to modify. DELETE always requires
 Management and runtime are intentionally separate. A Homarr administrator with board-modify permission places and
 configures the widget. After placement, query and action authorization follows the request's board permission. Public
 boards may execute queries for anonymous viewers, but mutations stay authenticated. This includes shared-cache
-invalidation: `RefreshButton` is disabled only without an active item or preview session, or in edit mode, while ordinary
-scheduled query rendering remains available to anonymous viewers.
+invalidation: `RefreshButton` is disabled for anonymous viewers, without an active item or preview session, and in edit
+mode, while ordinary scheduled query rendering remains available to anonymous viewers.
 
 Responses use bounded, versioned shared-Redis cache keys. Action invalidation advances the shared version so every
 Homarr replica stops serving the previous response without scanning or deleting a key prefix.