feat(support-admin): collapse same-label authorizations (#19)

[alejandro-runner]

Summary

Groups authorizations by label in the Synvya support-admin user detail view so a restaurant key with many rows renders as one card per label with an "N older" disclosure, instead of a flat scroll.

Motivates: production restaurants accumulating 4× Synvya Client (staging) / 2× Synvya Server (staging) rows per key (see PR #15 discussion). Duplicate creation is fixed in the Synvya client; cleanup is fixed in #18; this PR is the admin UX so the page is readable regardless of how many rows exist.

Changes

• groupAuthorizations(auths) helper: buckets by label (empty labels → (no label)); newest-first inside each group; groups sorted by most-recent row.
• Per-group card: color accent (green = Synvya Server, blue = Synvya Client) moves to the group header; row count badge on the header.
• Newest row shown inline; N older {label} authorizations disclosure expands the rest.
• Only active in the Synvya-gated view (isSynvyaManaged); diVine deployments keep the existing flat rendering.
• Supporting CSS for .auth-group, .auth-group-header, .auth-count-badge, .auth-card-plain, .auth-older-toggle, .auth-older-list, .auth-card-older.

Out of scope (per #19)

• No backend response-shape change — grouping is purely client-side.
• No dedupe-on-create (belongs in the Synvya client).
• Revoked-row toggle + grayed-out rendering: now that Add soft-delete (revoked_at) to team authorizations and admin cleanup endpoint #18 has landed, this is a good follow-up; opening a separate issue once the endpoint is wired into the UI.

Test plan

• svelte-check clean for this file (pre-existing errors elsewhere in the repo are unrelated).
• vite build transforms the file cleanly (build fails later on an unrelated unbuilt keycast-login/dist — not touched by this PR).
• Manual: open /support-admin, look up a user with a team whose restaurant key has duplicate-label authorizations; confirm one card per label, newest inline, N older expands, diVine rendering unchanged.
• Manual: user with zero duplicates still renders cleanly (one row per group, no disclosure).

Acceptance criteria

• Restaurant with 4× same-label auths renders as one card + "+3 older" disclosure.
• Visible row is always newest in its label group.
• Expanding reveals older rows inline with full meta.
• diVine (non-Synvya) deployments unaffected.

Closes #19

🤖 Generated with Claude Code