#1030 GET /analytics/queues reads tenant_id from the query string after require_permission checked the header tenant

Found during #1028 (live, public URL, 2026-10-20, read-only GETs). api/middleware/tenant.py takes g.tenant_id from X-Tenant-ID first, then ?tenant_id. api/blueprints/v1/analytics.py list_queue_analytics then re-reads request.args.get('tenant_id') or g.tenant_id. So a caller with view_analytics in tenant A sends X-Tenant-ID: A (permission passes for A) plus ?tenant_id=B and the query runs for B. Live: admin@test, X-Tenant-ID test, days=365: without the param -> test's queues (non-empty, e.g. my_workflow); with ?tenant_id=platform -> 200 and queues=[] (a different result set, so the query used tenant platform). Not shown: a non-empty second tenant (no known positive with data in another tenant yet), so the leak of actual rows is inferred, not observed. EARS: The analytics routes shall scope every query to g.tenant_id and shall ignore or reject a tenant_id query parameter that differs from it. Also sweep api/ for other request.args tenant_id reads after the middleware (submodule-aware grep).