feat(approvals): tenant-scoped queue (no cross-tenant work-items)

Plumbed me.tenant_id through api.ping + loginAs into the store as
tenantId. Approvals.loadQueue filters /api/ea2/work-items by
tenant_id matching the signed-in user so the queue only shows
actionable rows. Probe of EA2 work-items returned 73/80 in canvas's
tenant (a0000000-...), 6 in hms_dev, 1 in hub-cnt-f56ce0 -- those
7 are now hidden.

src/scenes/Approvals.tsx

@@ -35,10 +35,12 @@ export default function Approvals() {
   const [tx, setTx] = useState<RuntimeTransaction | null>(null);
   const [busy, setBusy] = useState<string | null>(null);
 
+  const tenantId = useApp((s) => s.tenantId);
   const loadQueue = async () => {
     try {
       const rows = await api.workItems();
-      setItems(rows.map((it) => ({ ...it, age_label: ageLabel(it) })));
+      const scoped = tenantId ? rows.filter((it) => (it as any).tenant_id === tenantId) : rows;
+      setItems(scoped.map((it) => ({ ...it, age_label: ageLabel(it) })));
     } catch (err: any) {
       pushToast("err", `Queue failed: ${err.message}`);
     }