feat(admin): DB-backed integration toggles + sticky cols + dark contrast

Builds on the env-var INTEGRATIONS_DISABLED shipped with the nav-design
overhaul.  Adds a DB-backed admin UI so operators can flip integrations
without editing .env and restarting the container, plus the remaining
visual cleanup items from the design backlog.

Integration toggles
- Migration 081 — integration_settings table (key PK, disabled flag,
  reason, disabled_by audit, disabled_at).  Seeded with all 13 known
  integrations as enabled.
- GET / PATCH /api/admin/integrations — gated by requirePermission
  (admin, access).  PATCH clears the in-process integration-health
  cache so toggles take effect within seconds.
- /admin/integrations admin page with a Switch per integration, optional
  reason input, audit-info subtitle (disabled by, when, why), live
  status light from /api/dashboard/integration-health.
- integration-health service merges env-var disable list with DB rows;
  degrades gracefully if migration unapplied / DB unreachable.
- Wired into the Admin nav dropdown (eight items now).
- CLAUDE.md describes both env + DB sources.

Sticky first column on tables
- Table primitive accepts stickyFirstColumn?: boolean.  When true, TH
  and TD :first-child stay pinned during horizontal scroll, with
  background inheritance preserving hover and selected row tints.
- DataTable exposes the prop too — on by default for paginated tables.
- /addigy-devices opts in.

Dark-mode contrast
- --border lifted from 10% to 14% in .dark; --input from 15% to 18%;
  --sidebar-border to 14%.
- StatusLight outline ring lifted from /10 to /15 (light) and /20 (dark).
- DetailModal empty-cell em-dash lifted from /40 to /70 so missing
  values are legible on dark surfaces.

DESIGN.md
- Closed sticky-first-column, dark-mode contrast, and palette-audit
  items (palette deprioritized — most uses are semantic).
- Skeleton helpers documented as preferred for new code; existing
  ad-hoc patterns left in place.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

CLAUDE.md

@@ -124,13 +124,18 @@ Examples: `getAutotaskClient()`, `getMsgraphClient()`, `getDattoRmmClient()`,
 
 ## Operator config
 
-- `INTEGRATIONS_DISABLED` — comma- or space-separated list of integration
-  keys (or aliases) to suppress from `/status` and the top-bar status light.
-  Disabled entries render muted, don't count toward failure summaries, and
-  don't flag the rollup. Set in `.env` and restart. Aliases:
-  `sentinelone` → `s1`, `datto` → `datto_rmm`, `it-glue` → `itglue`,
-  `ms-graph` → `msgraph`. Live auth checks still run (so logs still
-  surface the underlying state) but the UI ignores the result.
+- **Integration disable** — two sources, merged:
+  - `INTEGRATIONS_DISABLED` env var (legacy / bootstrap fallback).
+    Comma- or space-separated keys with aliases (`sentinelone` → `s1`,
+    `datto` → `datto_rmm`, `it-glue` → `itglue`, `ms-graph` → `msgraph`).
+    Set in `.env` and restart.
+  - **`/admin/integrations`** UI backed by the `integration_settings`
+    table (migration 081). Toggle without a container restart; takes
+    effect within the 5-minute health cache (PATCH clears the cache
+    immediately). Audit columns capture `disabled_by` (session email),
+    `disabled_at`, and an optional `disabled_reason`.
+  In both cases live auth checks still run (logs surface the underlying
+  state); the UI ignores the result for disabled integrations.
 
 ## Watch out for
 - A `.env` file is committed to the repo. Treat secrets as potentially real; don't