feat(admin): expose accountAuthorizations on the admin panel

[vbudhram]

Because

• Admins need visibility into which Firefox browser services (Sync, Smart Window, Relay, VPN) a user has authorized, to answer support questions about consent and connected services.
• An earlier admin-panel exposure of this data was closed when the underlying accountAuthorizations table was reverted; that table has since been rebuilt as a consent ledger, so the admin surface needs to be rebuilt against the new shape.

This pull request

• Adds DatabaseService.accountAuthorizations(uid) that reads per-(scope, service, clientId) rows from fxa_oauth, hex-encoding clientId and coercing BIGINT timestamps to numbers. Sort is lastAuthorizedTosAt desc with service / clientId tiebreakers; capped at 50 rows.
• Resolves a new accountAuthorizations field on the account REST response in account.controller.ts, gated by the existing ConnectedServices admin feature.
• Adds an AccountAuthorizations React component that renders Service / Scope / Client ID / First Authorized / Last Authorized columns, with an empty state.
• Adds the new "Authorized Browser Services" section to the account detail page (PageAccountSearch/Account/index.tsx) with an explanatory note clarifying rows are OAuth consent records, not active usage.
• Extends the AccountAuthorization and Account interfaces in fxa-admin-server/src/types.ts.

Issue that this pull request solves

Closes: https://mozilla-hub.atlassian.net/browse/FXA-13668

Checklist

• My commit is GPG signed.
• If applicable, I have modified or added tests which pass locally.
• I have added necessary documentation (if appropriate).
• I have verified that my changes render correctly in RTL (if appropriate).
• I have manually reviewed all AI generated code.

Other information

How to test:

1. Run yarn start infrastructure then yarn start mza.
2. Sign in to an account via fxa-settings and authorize a browser service flow (e.g. Sync, Relay).
3. In the admin panel, search for that account by email or uid.
4. Confirm an Authorized Browser Services section appears under Connected Services, with one row per (service, scope, clientId) showing the first and last consent timestamps.
5. For an account with no consents, confirm the "This account has not authorized any browser services" empty state renders.

Notes:

• Read-only against fxa_oauth.accountAuthorizations. No new migration or write path.
• Gated by AdminPanelFeature.ConnectedServices (existing admin feature flag).

[Copilot]

Pull request overview

Re-exposes the rebuilt accountAuthorizations ledger (per (scope, service, clientId) consent rows from fxa_oauth) on the FxA admin panel so support can see which Firefox browser services a user has authorized. The data flows from a new DatabaseService.accountAuthorizations(uid) reader, through a new REST controller resolver gated by the ConnectedServices admin feature, into a new React table on the account detail page.

Changes:

• Add DatabaseService.accountAuthorizations(uid) and a controller resolver wiring it into the account REST response, plus matching AccountAuthorization/Account type updates.
• Add an AccountAuthorizations React component (with empty state) and render it in a new "Authorized Browser Services" section on the account search page.
• Add unit/integration tests (incl. inline accountAuthorizations table creation in the DB spec) and a tiny adminPanel.spec.ts formatting tweak.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
packages/fxa-admin-server/src/types.ts	Add AccountAuthorization interface and accountAuthorizations field on Account.
packages/fxa-admin-server/src/rest/account/account.controller.ts	Import type, fan-out new resolver in Promise.all, and add gated accountAuthorizations(account) method.
packages/fxa-admin-server/src/database/database.service.ts	New accountAuthorizations reader: query fxa_oauth.accountAuthorizations, hex-encode clientId, coerce BIGINTs, limit 50.
packages/fxa-admin-server/src/database/database.service.spec.ts	Inline-create the table fixture and add ordering/empty-result integration tests.
packages/fxa-admin-panel/src/components/PageAccountSearch/AccountAuthorizations/index.tsx	New table component with empty state.
packages/fxa-admin-panel/src/components/PageAccountSearch/AccountAuthorizations/index.test.tsx	Tests for empty/null/populated rendering.
packages/fxa-admin-panel/src/components/PageAccountSearch/Account/index.tsx	Wire new prop and add "Authorized Browser Services" section with explanatory note.
packages/fxa-admin-panel/src/components/PageAccountSearch/Account/index.test.tsx	Extend default fixture and add empty/populated rendering tests.
packages/functional-tests/tests/admin/adminPanel.spec.ts	Reflow an overly long line; no behavior change.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.