fix(web): label the connection-wide default "All tools"

"Actions that change things" described the category rather than the scope of
the control. The row is the fallback for every tool without its own setting,
so it now says so.

Kept the qualifiers, since "All tools · Always allow" over-claims on its own:
reads never ask anyway, and the footnote below still spells out that raw
queries and code always ask regardless, and that scheduled runs and borrowed
access only use tools allowed individually.

Co-Authored-By: Claude <noreply@anthropic.com>

apps/web/components/settings/company-brain-tool-approvals.tsx

@@ -234,7 +234,7 @@ export default function CompanyBrainToolApprovals({
 										"text-[13px] text-[#FAFAFA]",
 									)}
 								>
-									Actions that change things
+									All tools
 								</p>
 								<p
 									className={cn(
@@ -242,8 +242,8 @@ export default function CompanyBrainToolApprovals({
 										"mt-0.5 text-[12px] leading-[1.5] text-[#737B87]",
 									)}
 								>
-									Creating, editing, sending — for tools without their own
-									setting below.
+									Applies to anything without its own setting below. Reads never
+									ask.
 								</p>
 							</div>
 							<Segmented