feat(admin): DB-backed integration toggles + sticky cols + dark contrast

Builds on the env-var INTEGRATIONS_DISABLED shipped with the nav-design
overhaul.  Adds a DB-backed admin UI so operators can flip integrations
without editing .env and restarting the container, plus the remaining
visual cleanup items from the design backlog.

Integration toggles
- Migration 081 — integration_settings table (key PK, disabled flag,
  reason, disabled_by audit, disabled_at).  Seeded with all 13 known
  integrations as enabled.
- GET / PATCH /api/admin/integrations — gated by requirePermission
  (admin, access).  PATCH clears the in-process integration-health
  cache so toggles take effect within seconds.
- /admin/integrations admin page with a Switch per integration, optional
  reason input, audit-info subtitle (disabled by, when, why), live
  status light from /api/dashboard/integration-health.
- integration-health service merges env-var disable list with DB rows;
  degrades gracefully if migration unapplied / DB unreachable.
- Wired into the Admin nav dropdown (eight items now).
- CLAUDE.md describes both env + DB sources.

Sticky first column on tables
- Table primitive accepts stickyFirstColumn?: boolean.  When true, TH
  and TD :first-child stay pinned during horizontal scroll, with
  background inheritance preserving hover and selected row tints.
- DataTable exposes the prop too — on by default for paginated tables.
- /addigy-devices opts in.

Dark-mode contrast
- --border lifted from 10% to 14% in .dark; --input from 15% to 18%;
  --sidebar-border to 14%.
- StatusLight outline ring lifted from /10 to /15 (light) and /20 (dark).
- DetailModal empty-cell em-dash lifted from /40 to /70 so missing
  values are legible on dark surfaces.

DESIGN.md
- Closed sticky-first-column, dark-mode contrast, and palette-audit
  items (palette deprioritized — most uses are semantic).
- Skeleton helpers documented as preferred for new code; existing
  ad-hoc patterns left in place.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

migrations/081_integration_settings.sql

@@ -0,0 +1,45 @@
+-- =============================================================================
+-- Integration toggle table
+-- =============================================================================
+-- Operator-managed disable list for the /status page and integration health
+-- summary.  Keyed by the same identifier the integration-health service
+-- emits (e.g. 's1', 'datto_rmm', 'itglue', 'msgraph', 'autotask', 'veeam',
+-- 'auvik', 'addigy', 'mimecast', 'duo', 'zabbix', 'qbo', 'anthropic').
+--
+-- The legacy INTEGRATIONS_DISABLED env var still works (its values merge with
+-- this table at read time), but DB-backed toggles take effect within the
+-- 5-minute health cache without a container restart.
+-- =============================================================================
+
+CREATE TABLE IF NOT EXISTS integration_settings (
+  key              TEXT PRIMARY KEY,
+  disabled         BOOLEAN NOT NULL DEFAULT false,
+  disabled_reason  TEXT,
+  disabled_by      TEXT,                            -- session.user.email
+  disabled_at      TIMESTAMPTZ,
+  created_at       TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  updated_at       TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+COMMENT ON TABLE integration_settings IS
+  'Per-integration operator config. Today only the disabled flag is exposed; expand as needed.';
+
+-- Seed empty rows for known integrations so the admin UI shows everything
+-- on first load even before anyone toggles anything.  The admin UI auto-
+-- discovers from the integration-health response, so this seed is purely
+-- a convenience.
+INSERT INTO integration_settings (key, disabled) VALUES
+  ('autotask',   false),
+  ('datto_rmm',  false),
+  ('itglue',     false),
+  ('s1',         false),
+  ('veeam',      false),
+  ('msgraph',    false),
+  ('auvik',      false),
+  ('addigy',     false),
+  ('mimecast',   false),
+  ('duo',        false),
+  ('zabbix',     false),
+  ('qbo',        false),
+  ('anthropic',  false)
+ON CONFLICT (key) DO NOTHING;