Let standard techs use profiles without sign-in; flag unshared ones

Standard technicians (TechN0/TechN1) are no longer auto-prompted for a
delegated SharePoint sign-in when selecting a profile — only admins are.
Techs operate under the profile's app (certificate) identity, so a profile
selection never forces them to authenticate.

To keep that usable, the admin profile list now shows a "No shared access"
badge on any profile that isn't certificate-configured, since standard
techs can't operate against those until an admin registers a cert.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Components/Pages/Profiles.razor

@@ -79,6 +79,13 @@
             {
                 <span class="chip chip-green">@T["profiles.active"]</span>
             }
+            @if (!AppOnlyFactory.IsConfigured(p))
+            {
+                <span class="chip chip-yellow"
+                      title="No certificate configured — standard technicians can't use this profile. Open it and run 'Register app' (or upload a certificate) to enable shared access.">
+                    ⚠ No shared access
+                </span>
+            }
             <button class="btn btn-secondary btn-sm" @onclick="() => SelectProfile(p)">
                 @(Session.CurrentProfile?.Id == p.Id ? T["profiles.selected"] : T["profiles.select"])
             </button>