[UI] Patches list shows every patch as Pending in All-orgs mode (approvalStatus requires orgId)

[ToddHebebrand]

Description

GET /patches only computes approvalStatus when ?orgId= is present, and the web client injects orgId only when a specific org is selected in the org switcher. In "All orgs" mode the Patches tab therefore renders every patch as Pending — including patches that have a partner-wide approval (patch_approvals.ring_id IS NULL).

Since approvals are partner-scoped (not org-scoped), the All-orgs view is exactly where an MSP would expect to see approval state — and it's wrong there.

Repro

Seeded dev stack, partner admin, org switcher on "All orgs" → /patches#patches → a patch with an existing partner-wide approval shows a Review/Pending state. Select a specific org → same patch shows Approved.

Proposed Fix

Compute approvalStatus from the caller's partnerId when no orgId is supplied (approvals don't need an org axis), or have the list endpoint fall back to partner-wide approvals.

Affected Files

• apps/api/src/routes/patches/list.ts

[bdunncompany]

This looks already fixed on main by #2601 (merged earlier today). apps/api/src/routes/patches/list.ts now resolves the partner from the caller's own scope when no orgId is supplied:

const approvalPartnerId = query.orgId
  ? await resolvePartnerIdForOrg(query.orgId)
  : (auth.scope !== 'organization' ? auth.partnerId : null);

so the All-orgs (no-orgId) list joins patch_approvals on the caller's partnerId and reads back partner-wide approvals (including ring_id IS NULL) instead of defaulting to pending. That's exactly the proposed fix here, so this may be a stale duplicate of #2597 — worth a quick re-verify on current main before reworking.