fix: gate unfinished surfaces honestly (oracle round 2)

- Login.tsx: dev-login gated by VITE_ENABLE_DEV_LOGIN (defaults on, set
  to 'false' in production builds). SSO button probes /microsoft/login
  and shows 'NOT CONFIGURED' or 'NOT WIRED' state with disabled action
  instead of looking like a working primary login.
- Hub.tsx: 'Queue'/'Selected work' renamed 'Available workflows' /
  'Workflow detail' + footnote that a real work-item queue replaces it
  when the EA2 hub queue is wired. No more semantic overclaim.
- Landing.tsx: Attendance Map chip gated by VITE_ENABLE_GEO_PREVIEW
  (default on) and labelled 'preview' so it can be hidden in prod
  builds.
- flowCuration.ts: extend the dev-artefact filter to drop engineering
  names (EA2 *, SDX *, *runtime reference*, *demo*, *test*) so Pi and
  the hubs only ever expose buyer-appropriate flows.
- All 29 unit tests + 26 dogfood QA assertions still green.

src/scenes/Landing.tsx

@@ -79,7 +79,9 @@ export default function Landing() {
             <button className="hub-chip" onClick={() => setScene("hub-procurement")}>Procurement Hub</button>
             <button className="hub-chip" onClick={() => setScene("hub-hr")}>People Hub</button>
             <button className="hub-chip" onClick={() => setScene("hub-it")}>IT Hub</button>
-            <button className="hub-chip" onClick={() => setScene("geo-attendance")}>Attendance Map</button>
+            {(import.meta.env.VITE_ENABLE_GEO_PREVIEW ?? "true") !== "false" && (
+              <button className="hub-chip" onClick={() => setScene("geo-attendance")}>Attendance Map · preview</button>
+            )}
             <button className="hub-chip" onClick={() => setScene("agent")}>Command Assistant</button>
             <button className="hub-chip" onClick={() => setScene("chat")}>Team Chat</button>
             <button className="hub-chip" onClick={() => setScene("explainer")}>What is FlowMaster?</button>