refactor(admin): read the off-host card from evidence, sort the worst row first

Four smaller things around the same card.

The configured flag came from the environment of whichever process serves the
request. A hand-rolled split that gives BACKUP_S3_* to the worker and not to
the web process would have shown an operator "nothing leaves this host" over a
ledger full of fresh rows. The ledger is queried either way now, and a row in
it outranks an environment read: a row is proof an upload happened.

Rows sorted by username put the one account that needs attention wherever the
alphabet leaves it, which on a hundred-account cohort is the crowd problem the
card exists to end, moved from a count into a list. Worst verdict first,
alphabetical within a verdict, decided server-side so the tests and the
accessibility fixture see the order the operator does.

The card's docblock claimed the worker holds PutObject and GetObject. The
runbook is right and the multipart path needs AbortMultipartUpload too, so the
prose no longer documents a grant that would break the uploader.

And the byte formatter moved to lib. The off-host card was importing it out of
a thousand-line client component, which costs nothing while both cards render
on one route and becomes a cost the moment either moves.

src/types/backups.ts

@@ -49,7 +49,7 @@ export interface OffhostAccountRow {
  *
  * Computed from the ledger the nightly worker writes, never from the bucket:
  * the page must be able to answer "does this account have a recent copy
- * off-host" on a host whose worker holds PutObject and nothing else.
+ * off-host" on a host whose worker holds no listing grant on the bucket.
  */
 export interface OffhostBackupOverview {
   /** Whether this host has the variables the nightly job needs. */