chore(sase): show emails in plain text — drop masking + reveal flow

User decision: emails should display openly on the panel (Tailscale-only,
single founder). The reveal-with-audit pattern was overkill for this
trust model and added a click per inspection.

- List page: u****@x.com → u.email
- Detail header: <EmailReveal/> → plain <span>{user.email}</span>
- Delete _email-reveal.tsx + /api/sase/users/[id]/reveal-email route
- Delete maskEmail() helper (no remaining callers)

Audit log no longer captures per-email reveals; the audit tab now only
shows lifecycle/billing/impersonation actions, which is what we actually
care about.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

apps/web/src/app/api/sase/users/[id]/reveal-email/route.ts

@@ -1,41 +0,0 @@
-import { NextResponse } from "next/server";
-import { headers } from "next/headers";
-import { auth } from "@/lib/auth";
-import { saseDb } from "@/lib/db-sase";
-import { writeAudit } from "@/lib/audit";
-
-export const dynamic = "force-dynamic";
-
-export async function POST(
-  _req: Request,
-  ctx: { params: Promise<{ id: string }> },
-) {
-  const session = await auth.api.getSession({ headers: await headers() });
-  if (!session) {
-    return NextResponse.json({ ok: false, error: "unauthenticated" }, { status: 401 });
-  }
-  const { id } = await ctx.params;
-
-  const user = await saseDb.user.findUnique({
-    where: { id },
-    select: { email: true },
-  });
-  if (!user) {
-    await writeAudit({
-      projectKey: "sase",
-      endpoint: `/api/sase/users/${id}/reveal-email`,
-      method: "POST",
-      responseStatus: 404,
-    });
-    return NextResponse.json({ ok: false, error: "not_found" }, { status: 404 });
-  }
-
-  await writeAudit({
-    projectKey: "sase",
-    endpoint: `/api/sase/users/${id}/reveal-email`,
-    method: "POST",
-    responseStatus: 200,
-  });
-
-  return NextResponse.json({ ok: true, email: user.email });
-}