NodeLink storage console gaps found while repairing

Found while running Repair policy on GMind's prod store and on dev's managed "Main VPC" location (Task 6689). 1. Settings › Infrastructure › NodeLink storage: the location card shows "NodeLinks 1 / Tenants 1" but does not name them. List each tenant and NodeLink with a link, so an operator can check what a Repair will admit before pressing it. 2. Machines › NodeLink as the operator with "All orgs" says "No NodeLinks yet" even though tenants have NodeLinks. Show tenants' NodeLinks there too, read-only, with their org. 3. An org's NodeLink storage cannot change its AWS credential in the UI. GMind's adopted store is bound to a credential whose IAM user lacked PutFileSystemPolicy, and the only fix was IAM. Allow re-picking the credential, validated like "Use existing" does. 4. When Repair fails after the policy was already written, the error ("HTTP 500, retry") hides the fact that the policy changed. Show what was written, for example the policy's admitted access points and a timestamp, on the Storage tab. 5. The Storage tab does not say whether the live policy carries the mount-target condition. Show a "Policy current / outdated" fact read from AWS, so a stale policy is visible without the CLI. 6. GMind's store credential (`jaah-node-launcher`) still lacks CreateAccessPoint, DeleteAccessPoint and TagResource. A new NodeLink on that store would fail to provision. Either grant those on that file system, or move the store to the NodeLink provisioner identity. Out of scope: the EFS policy document itself. Done means: each item above is shipped or explicitly declined with a reason.

Merged PR #5646. Shipped items 1, 3, 4 and 5. Item 2 was already shipped (Task 6690). Item 6 is Terraform; the IAM apply is a human step. Full gate was green before the rebase. 4 unrelated web tests fail on develop itself. The dev deploy hit a runner shutdown; a newer deploy supersedes it.