Admin pages polish: Organizations, Directory, Security

Goal: the admin surfaces fit at 1280–1440px and 390px with nothing clipped or wrapped, say why a control is disabled, and carry no noise. Supersedes drafts 7537, 7503, 7496 (items 2–3), 7491, 7480 (items 2–5), 7492, 7524 and 7532 (items 1, 3, 4). **Settings › Organizations** - The tab strip stays on one row: scrollable, or with security tabs grouped under "Security". - One plan notice replaces an Upgrade chip on every tab. - The SSO Metadata URL field grows to fit on phone. - The "Others see your email" banner remembers its dismissal per user. - The Access tab's Remove action is fully visible at 1280px. **Security tab** - The phone jump list shows that it scrolls (edge fade or chevron). - Isolation and Providers show Save only once something changes. **Directory (People / Groups / user record)** - Drop the "(global)" suffix on unscoped Revoke. - Disabled ⋯ items dim the verb only, keeping the reason readable. - User record tabs stay on one row at 390px. - The Groups count excludes Everyone. - The "Set up your company" panel never hides list rows on phone. - NAME uses the same font size as EMAIL. - System group descriptions use one punctuation convention. - MFA enrolment says which org policy requires it. **Billing / Subscription** - The held plan is marked "Current plan". - "Upgrade — coming soon" is a muted label, not a disabled button. - The phone Products row keeps the "Ends <date>". - Free says why it cannot be chosen yet. **Profile › Alerts** - Save aligns with the table edge. - A disabled Save says why. - The Send-all hover area matches the row checkboxes. **Misc** - The Change-org dialog shows no caption that repeats the field. - The unrouted-notifications notice names the affected orgs. - Audit › Activity labels `notification_unrouted`. Out of scope: SSO/SCIM/IP-allowlist behaviour, access logic, billing logic and prices, notification delivery. Done means: - Each item is shipped or declined with a one-line reason. - Screenshots of each changed surface at desktop and 390px. - Vitest for each shipped behavioural item. Required checks: ./dc check full

Admin polish: 23 of 25 items shipped, with vitest and API tests. Current plan was already shipped on develop (Task 7606) and the banner was already done. PR #6154 is queued in the merge lane. Quick gate green; full gate red only in suites this PR doesn't touch (jaahd git, flaky TaskDetailPage.live), so CI and the lane are the gate. Follow-ups: draft 7660.