Brains roster and New account polish

Quality goals for Machines › Brains (/accounts) and New account (was #8331, #8384, #8465, #8534). Skip anything already fixed. Roster: 1. A member the route admits never sees "Failed to load accounts": return what they may see (maybe none); a refused read says so in words. 2. One enabled mark on desktop and phone; a read-only state (another org's account) is clearly not a button. 3. Long names stay whole before the email truncates; on phone the state is separated from the email. 4. Expanded node rows: state words in their own column, clear of the 5H/7D headers; normal gap before "on <host>"; NodeLink icon beside the name on phone. New account: 5. No loose gap under a closed Advanced (`ui/AdvancedSection` margin). 6. Off-plan providers: one short line, names in a tooltip. 7. Authenticate opens the vendor tab on the click (blank tab, then the link; keep `noopener`) so popup blockers don't stop it. 8. Provider and Authentication share a row at 448 px (shorter "Subscription" label). Out of scope: who may see or edit accounts, account sign-in rules, the account form's field set, the welcome wizard, the Nodes page. Done means: - Each item fixed or declined with a one-line reason in the PR. - `Accounts.test.tsx` covers the refused-read case. - Screenshots at 1440 px and 390 px.

All 8 Brains roster / New account items fixed in PR #6489 (merged c0ff81c, Jaah Deploy green). Quick gate + 588 changed-area tests green; review lanes passed; screenshots 1440/390/448 in report. Follow-ups filed as draft #8596. Memory: none applied.