refactor(settings): one header, one action row, one integration card

The sweep that follows from the primitives. Nothing here is new behaviour;
every change removes a second way of saying something the surface already
said one way somewhere else.

Headers. The two collapsible security cards stop rebuilding
`SettingsCardHeader` by hand to carry a chevron — the chevron rides inside
the title button, and the description moves out of the collapsed region, so
the first paint is no longer a bare title. The import card shell, the export
and import section headings, and the four free-standing group headers stop
inventing their own type scale: a heading above a GROUP of cards is
`SectionHeading` (`text-base`), a card title is `SettingsCardHeader`
(`text-lg`), and the step between them is what says which is which. The
targets card gets a title instead of a naked icon.

Actions. Every card-level row is `SettingsCardActions`. The primary action
comes out of the header's status slot in six cards (password, web push,
pillar order, coach memory, and the two danger-zone triggers) and out of the
middle of the card in three more; the reset that hung in the dashboard-layout
header joins save as a secondary in the same row. Result and status lines
move ABOVE the row — sources' cross-link, the invite form's two status lines
— because nothing follows a card's actions. Revoking a share link is
`variant="destructive"` rather than an `outline` hand-tinted red in two
different ways. The import row had four variants for four buttons; it has
two. Export downloads are the card's primary, not an outline link.

Integrations. One description sentence with the setup-guide link inline: the
second paragraph was byte-identical across six of eight cards, which is the
tell that it said nothing about the provider it sat under. The `<hr>` under
the header — which existed only in this folder — is gone. So is the hint that
pointed at a guide 40 px above it, and the second format for "not
configured". Connect is one button everywhere: primary, `sm`, in the action
row, instead of primary-and-small in three cards and outline-and-large in
four.

Plus the standards leftovers the audit listed: two `pl-5` list gutters, one
`scroll-mt-20` anchor, a purple header icon, `text-[10px]` badges, four
hand-rolled callout shells that `SettingsInfoTile` already paints, and the
two inline buttons that never had the mobile tap floor at all.

src/components/settings/integrations/__tests__/apple-health-card.test.tsx

@@ -146,12 +146,12 @@ describe("<AppleHealthCard>", () => {
     expect(html).toContain("quiet");
   });
 
-  it("carries the shared card divider like every sibling", () => {
+  it("carries no card divider — the card gap does that job", () => {
     statusPayload = {
       lastSyncedAt: null,
       syncHealth: { verdict: "pending_first_sync", since: null },
     };
-    expect(render()).toContain('data-testid="integration-card-divider"');
+    expect(render()).not.toContain('data-testid="integration-card-divider"');
   });
 
   it("links to the existing one-shot Apple Health import fallback", () => {

src/components/settings/integrations/__tests__/nightscout-card.test.tsx

@@ -80,13 +80,13 @@ describe("NightscoutCard — parked + test + data-link + invalidation", () => {
     expect(html).toContain('href="/insights/blood-glucose"');
   });
 
-  it("carries the shared card divider like every sibling", () => {
+  it("carries no card divider — the card gap does that job", () => {
     const html = render({
       connected: true,
       configured: true,
       syncHealth: { verdict: "fresh", since: null },
     });
-    expect(html).toContain('data-testid="integration-card-divider"');
+    expect(html).not.toContain('data-testid="integration-card-divider"');
   });
 
   it("renders the per-metric freshness disclosure with a stale row", () => {