fix(oracle-l6): close 2 actionable caveats

1. Approvals tenantId hydration race
   loadQueue used to fall back to 'show all rows' when tenantId was
   null. Now early-returns []  until tenantId hydrates, and the effect
   depends on tenantId so it reloads once auth completes.

2. Settings persona quick-switch threw 'Password required'
   signIn() in Settings called loginAs(email) without options.method.
   Now explicit { method: 'dev' } so the documented dev-login path
   is used.

src/scenes/Approvals.tsx

@@ -37,16 +37,20 @@ export default function Approvals() {
 
   const tenantId = useApp((s) => s.tenantId);
   const loadQueue = async () => {
+    if (!tenantId) {
+      setItems([]);
+      return;
+    }
     try {
       const rows = await api.workItems();
-      const scoped = tenantId ? rows.filter((it) => (it as any).tenant_id === tenantId) : rows;
+      const scoped = rows.filter((it) => (it as any).tenant_id === tenantId);
       setItems(scoped.map((it) => ({ ...it, age_label: ageLabel(it) })));
     } catch (err: any) {
       pushToast("err", `Queue failed: ${err.message}`);
     }
   };
 
-  useEffect(() => { void loadQueue(); }, []);
+  useEffect(() => { void loadQueue(); }, [tenantId]);
 
   useEffect(() => {
     if (!activeKey) return;

src/scenes/Settings.tsx

@@ -32,7 +32,7 @@ export default function Settings() {
   const signIn = async (email: string) => {
     setSigningIn(true);
     try {
-      await loginAs(email);
+      await loginAs(email, undefined, { method: "dev" });
     } finally {
       setSigningIn(false);
     }