feat(curation): fetchStartableFlows supplements catalogue listing

The /api/ea2/flow/processes endpoint caps at ~203 items and pr_to_po_def
is not in that window for this tenant despite being status=published.
fetchStartableFlows() does a direct GET per allowlist key and merges
results with the catalogue list (allowlist hits take precedence).

Wired into Hub.loadPublishedFlows + agentTools.list_processes +
agentTools.start_process.

qa/probe_hub_curation.mjs

@@ -0,0 +1,20 @@
+import { chromium } from "playwright";
+const args = ["--host-resolver-rules=MAP canvas.flow-master.ai 65.21.71.186", "--ignore-certificate-errors"];
+const b = await chromium.launch({ headless: true, args });
+const p = await (await b.newContext({ viewport: { width: 1440, height: 900 } })).newPage();
+p.on("response", async (r) => {
+  if (/\/api\/ea2\/flow\/processes/.test(r.url())) {
+    const t = await r.text().catch(() => "");
+    console.log(`[catalogue ${r.status()}] ${r.url().replace("https://canvas.flow-master.ai","")} → ${t.slice(0,500)}`);
+  }
+});
+await p.goto("https://canvas.flow-master.ai/", { waitUntil: "networkidle" });
+await p.waitForTimeout(800);
+await p.locator(".persona-chip", { hasText: /Mariana/ }).click();
+await p.locator(".dev-login-btn").click();
+await p.waitForTimeout(2500);
+await p.locator(".hub-chip", { hasText: /Procurement Hub/ }).click();
+await p.waitForTimeout(3000);
+const flowCards = await p.locator(".hub-queue-row, .hub-flow-title").allTextContents();
+console.log(`flowCards: ${flowCards.length} | ${JSON.stringify(flowCards.slice(0,5))}`);
+await b.close();