chore(kanban): tier-2 medium bug-fix batch

[teknium1]

Summary

Three contributor bug fixes salvaged onto current main, authorship preserved via rebase-merge. A fourth (#18518) verified as already on main and will be closed with credit, not re-merged.

What changed

commit	author	PR	what
6f8dd58	@cirwel	#19475	preflight missing Codex profile auth before dispatch
485a1d0 + 8d7ba19	@maciekczech	#19817	filter dashboard board by selected tenant (client-side)
a712947	@LeonSGP43	#20508	expose send_kanban_blocked helper on TelegramAdapter (resolves #20263)

Plus AUTHOR_MAP entry for @maciekczech.

Root causes + fixes

#19475 — Codex profile auth preflight. Kanban workers dispatched under an assignee whose profile is configured for openai-codex but has no profile-local auth.json would spawn successfully, exit immediately on provider validation, then re-enter the dispatch loop via the failure counter. New _preflight_worker_profile_auth reads only non-secret metadata (config.yaml provider + auth.json presence/size) and fails the dispatch with a clear error pointing at hermes -p <profile> auth. Scoped to openai-codex via _AUTH_STORE_REQUIRED_PROVIDERS; extensible when other OAuth providers show the same pattern.

#19817 — tenant filter client-side gap. The dashboard already sends ?tenant=X to the API, but the client-side filterTask function inside useMemo(filteredBoard) only checked assigneeFilter and search. Switching tenants left stale cards visible until a full reload finished. Two-line fix: add tenant predicate + tenant to the useMemo dep array. Two bundle-inspection tests added to prevent regression.

#20508 — TG adapter API drift. @leonardsellem's homelab guardrails plugin calls TelegramAdapter.send_kanban_blocked which we never shipped, forcing downstream getattr defense. Adds a small delegator that formats a ⏸ Kanban <id> blocked: <reason> message and routes through the standard send() path. Accepts both positional and dict-shaped task args for forward-compat.

Validation

• tests/hermes_cli/test_kanban_db.py + tests/plugins/test_kanban_dashboard_plugin.py + tests/gateway/test_telegram_thread_fallback.py: 144/144 passing
• Merge conflict on fix(kanban): preflight missing Codex profile auth #19475 was a stale-branch collision with has_spawnable_ready() (landed post-PR-branch-point); resolved by keeping both.

[teknium1]

Closing as superseded — all four sub-PRs in this batch (#19475, #19817, #20508, #18518) are already closed via other paths since this batch was opened. The Codex preflight (#19475) and send_kanban_blocked (#20508) substance may still be missing from main and worth a fresh focused PR if needed; the tenant-filter client-side change appears applied already.