fix: gate unfinished surfaces honestly (oracle round 2)

- Login.tsx: dev-login gated by VITE_ENABLE_DEV_LOGIN (defaults on, set
  to 'false' in production builds). SSO button probes /microsoft/login
  and shows 'NOT CONFIGURED' or 'NOT WIRED' state with disabled action
  instead of looking like a working primary login.
- Hub.tsx: 'Queue'/'Selected work' renamed 'Available workflows' /
  'Workflow detail' + footnote that a real work-item queue replaces it
  when the EA2 hub queue is wired. No more semantic overclaim.
- Landing.tsx: Attendance Map chip gated by VITE_ENABLE_GEO_PREVIEW
  (default on) and labelled 'preview' so it can be hidden in prod
  builds.
- flowCuration.ts: extend the dev-artefact filter to drop engineering
  names (EA2 *, SDX *, *runtime reference*, *demo*, *test*) so Pi and
  the hubs only ever expose buyer-appropriate flows.
- All 29 unit tests + 26 dogfood QA assertions still green.

src/lib/flowCuration.ts

@@ -21,6 +21,11 @@ const DEV_ARTEFACT_PATTERNS = [
   /\bsmoke[_\s]?test\b/i,
   /\bprobe\b/i,
   /\bfixture\b/i,
+  /\bea2\b/i,
+  /\bsdx\b/i,
+  /\bruntime reference\b/i,
+  /\bdemo\b/i,
+  /\btest\b/i,
 ];
 
 const NON_BUSINESS_SOURCE_CONTEXTS = new Set([