fix: uncommitted review fixes

- Document app-modify-all requirement on API endpoints (docs/api)
- Skip implied hint rendering for admin category row
- Fix spotlight apps search group visibility for app-modify-all users

apps/docs/docs/management/api/index.mdx

@@ -63,6 +63,10 @@ curl -H 'ApiKey: <id>.<token>' http://localhost:7575/api/health/live
 curl -H 'ApiKey: <id>.<token>' http://localhost:7575/api/trpc/app.all
 ```
 
+### App Endpoint Permissions
+
+The app endpoints (`/api/apps/paginated`, `/api/apps`, `/api/apps/search` and the corresponding tRPC procedures and MCP tools) require the `app-modify-all` permission. API keys inherit the permissions of the user who created them, so a key can only list apps when its owner can manage apps. Endpoints that only read app metadata for board placement (`/api/apps/selectable`, `/api/apps/{id}`) remain available to signed-in users without this permission.
+
 ### Use Cases
 
 API key authentication enables programmatic access for:

apps/nextjs/src/app/[locale]/manage/users/groups/[id]/permissions/_group-permission-form.tsx

@@ -132,6 +132,10 @@ export const MatrixImpliedHint = ({ category, permissionLabels }: MatrixImpliedH
   const form = useFormContext();
   const tPermissions = useScopedI18n("group.permission");
 
+  if (category === "admin") {
+    return null;
+  }
+
   const level = getMatrixLevel(form.getValues(), category);
   if (level === 0) {
     return null;

packages/spotlight/src/modes/app-integration-board/index.tsx

@@ -18,7 +18,7 @@ export const appIntegrationBoardMode = {
     }
 
     return groups.concat(
-      session.user.permissions.includes("board-modify-all")
+      session.user.permissions.includes("app-modify-all") || session.user.permissions.includes("board-modify-all")
         ? [appsSearchGroup, integrationsSearchGroup]
         : [integrationsSearchGroup],
     );