fix(hubs): exclude chat/wizard-step flows and tighten hub regexes

- loadPublishedFlows: drop source_context EA2_CHAT_THREAD/_MSG and
  EA2_WIZARD_STEP so chat threads and wizard fragments don't leak into
  the business catalogue
- procurement match: require word boundaries on PO/P2P; add requisition/
  invoice
- HR match: word-bound HR; add offboard/employee/payroll
- IT match: word-bound IT; explicit access/laptop/password tokens; drop
  the over-broad bare 'service' and 'account' tokens

qa/audit_hubs.mjs

@@ -0,0 +1,30 @@
+import { chromium } from "playwright";
+
+const URL = "https://canvas.flow-master.ai/";
+const args = ["--host-resolver-rules=MAP canvas.flow-master.ai 65.21.71.186", "--ignore-certificate-errors"];
+
+const b = await chromium.launch({ headless: true, args });
+const p = await (await b.newContext({ viewport: { width: 1440, height: 900 } })).newPage();
+
+await p.goto(URL, { waitUntil: "networkidle" });
+await p.waitForTimeout(800);
+await p.locator(".persona-chip", { hasText: /Mariana/ }).click();
+await p.locator(".dev-login-btn").click();
+await p.waitForTimeout(2500);
+
+const chips = await p.locator(".hub-chip").allTextContents();
+console.log("[landing] hub chips:", chips);
+
+for (const hub of ["Procurement Hub", "People Hub", "IT Hub"]) {
+  await p.locator(".hub-chip", { hasText: hub }).click();
+  await p.waitForTimeout(2200);
+  const title = await p.locator(".mc-hero-title").first().textContent();
+  const quickActions = await p.locator(".hub-quick-title").allTextContents();
+  const flowCards = await p.locator(".hub-flow-title").allTextContents();
+  console.log(`\n[${hub}] title=${title?.trim()} | quick=${quickActions.length} | flows=${flowCards.length}`);
+  console.log(`  flows visible (top 3): ${flowCards.slice(0, 3).join(" | ")}`);
+  // navigate back to landing
+  await p.locator(".tab", { hasText: /Home/ }).first().click().catch(() => {});
+  await p.waitForTimeout(700);
+}
+await b.close();