What am I agreeing to when a site asks to “approve token spending”?

You are giving a smart contract standing permission to move that token out of your account — not once, but until you take the permission away. Exchanges and marketplaces genuinely need this to work; it is also the usual route by which a wallet is emptied long after the approval was granted and forgotten.

The wallet turns the request into a sentence rather than showing you hex, and:

• an unlimited allowance is labelled as unlimited, not printed as a 78-digit number;
• amounts are read from the token's own contract, not from whatever the site claims;
• the raw data is always one tap away if you want to see it;
• if the site is asking on a different network from the one you are on, the wallet stops and offers to switch rather than signing on the wrong chain.

Approve only what the thing you are doing needs, be wary of unlimited on a site you have just met, and see the next answer for taking approvals back.