feat(signage): template management controller

Adds /api/engine/v2/signage/templates mirroring the playlists controller:
group-permission access via GroupSignageTemplate junctions, sharing,
approvers / request_approval / approve endpoints.

Drafts are transparent: routes address the approved (parent) template id.
index lists live templates only; show returns the pending draft when one
exists (?approved=true for the live version). PATCH applies metadata
directly to the parent (synced to any draft) while layout changes stage
onto a draft when the template is already approved; approve promotes the
draft via approve_draft! and DELETE /:id/draft discards pending changes.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: stakach