fix(patches): persist all-orgs approval status on reload (#2597)

[ToddHebebrand]

Problem

Reported in #2597: in the All orgs view → Patching → Microsoft, approving a patch shows it as approved, but navigating away and back reverts it to pending. Single-org view works fine.

Root cause

The approve write is durable and correct in both views — POST /patches/bulk-approve upserts a partner-wide patch_approvals row (partner_id = auth.partnerId, ring_id NULL). patch_approvals is a partner-scoped table.

The bug is on the read path. GET /patches computed each patch's approvalStatus only inside an if (query.orgId) { … } block:

• Single-org view injects ?orgId=<uuid> (via orgStore.currentOrgId), so the branch fires, resolves the org's partner, reads the approval, and shows approved.
• All orgs view has currentOrgId === null, so no orgId is sent. The branch is skipped, patch_approvals is never queried, and every patch falls back to 'pending' — even though the approval row exists.

Fix

apps/api/src/routes/patches/list.ts — resolve the approval partner from the caller's own token when no orgId is supplied:

const approvalPartnerId = query.orgId
  ? await resolvePartnerIdForOrg(query.orgId)
  : (auth.scope !== 'organization' ? auth.partnerId : null);

This mirrors what the write path already does (auth.partnerId). It's gated on partner/system scope so an org-scoped token — which can carry a partnerId but must never read partner-axis rows — still skips the read. The partner is always server-derived, so the existing system-context read never widens tenant visibility.

Ring-scoped reads use a different endpoint (/update-rings/:id/patches) and are unaffected; this only fixes the blanket partner-wide (ring_id NULL) case that the all-orgs view uses.

Tests

apps/api/src/routes/patches/index.test.ts (+2):

• All-orgs partner caller (no orgId) surfaces approvalStatus: 'approved', and the read is scoped to the caller's own token partner.
• Org-scoped caller with no orgId stays pending and never issues the partner-scoped approvals read (tenant-isolation guard — exactly 3 base selects).

All 31 tests in the suite pass; tsc --noEmit -p apps/api/tsconfig.json is clean.

Closes #2597

🤖 Generated with Claude Code

[cloudflare-workers-and-pages]

Deploying breeze with    Cloudflare Pages

Latest commit:	ab1de1d
Status:	✅  Deploy successful!
Preview URL:	https://d5fe56fa.breeze-9te.pages.dev
Branch Preview URL:	https://toddhebebrand-issue-2597-all.breeze-9te.pages.dev

View logs