feat(approvals): tenant-scoped queue (no cross-tenant work-items)

Plumbed me.tenant_id through api.ping + loginAs into the store as
tenantId. Approvals.loadQueue filters /api/ea2/work-items by
tenant_id matching the signed-in user so the queue only shows
actionable rows. Probe of EA2 work-items returned 73/80 in canvas's
tenant (a0000000-...), 6 in hms_dev, 1 in hub-cnt-f56ce0 -- those
7 are now hidden.

src/lib/api.ts

@@ -333,10 +333,10 @@ export const api = {
   },
 
   /** Probe whether the backend is reachable. Never throws. */
-  async ping(signal?: AbortSignal): Promise<{ ok: boolean; reason?: string; user?: string; user_id?: string }> {
+  async ping(signal?: AbortSignal): Promise<{ ok: boolean; reason?: string; user?: string; user_id?: string; tenant_id?: string }> {
     try {
       const me = await this.me(signal);
-      return { ok: true, user: me.email, user_id: me.user_id };
+      return { ok: true, user: me.email, user_id: me.user_id, tenant_id: me.tenant_id };
     } catch (e) {
       return { ok: false, reason: (e as Error).message };
     }