fix(admin): default api-tokens + login-overview routes to expanded

Pre-phase-4b these sections were cards on the long monolithic /admin
scroll, where the expand-to-reveal kept 100+ table rows from
dominating the overview. Post-phase-4b they each own a dedicated
route reachable via the sidebar / mobile strip — the user has already
opted into the topic by navigating there. Landing on a card with only
a header and an "Expand" button reads as "is this page broken?".

Default `expanded = true`; the toggle stays as an escape hatch.

Closes H3 from .planning/phase-6-design-findings.md.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/components/admin/api-token-overview-section.tsx

@@ -11,7 +11,10 @@ import { type ApiTokenInfo } from "./_shared";
 
 export function ApiTokenOverviewSection() {
   const { t } = useTranslations();
-  const [expanded, setExpanded] = useState(false);
+  // v1.5 phase-4b moved this to a dedicated route (`/admin/api-tokens`),
+  // so the user has already opted into seeing tokens by visiting the
+  // page. Default to expanded; the toggle stays as an escape hatch.
+  const [expanded, setExpanded] = useState(true);
 
   const { data: tokens, isLoading } = useQuery({
     queryKey: ["admin", "tokens"],

src/components/admin/login-overview-section.tsx

@@ -16,7 +16,11 @@ import { type AdminAuditEntry } from "./_shared";
 
 export function LoginOverviewSection() {
   const { t } = useTranslations();
-  const [expanded, setExpanded] = useState(false);
+  // v1.5 phase-4b moved this to a dedicated route
+  // (`/admin/login-overview`), so the user has already opted into the
+  // audit log by visiting the page. Default to expanded; the toggle
+  // stays as an escape hatch.
+  const [expanded, setExpanded] = useState(true);
   const [filter, setFilter] = useState<"all" | "failed">("all");
 
   const AUTH_ACTION_LABELS: Record<string, string> = {