Match page width to sso-manager-node; gate Audit nav to admins

- Dashboard, Sessions, and Audit pages now wrap their content in
  <div class="container mt-4">, matching sso-manager-node/proxy's width
  instead of rendering full-bleed inside the fluid shell.
- Audit's nav entry now carries groups: ['admin'] (utils/ui.js), reusing
  the existing synthetic-admin-group nav-gating convention -- the API
  route was already server-side admin-gated, this closes the last gap by
  hiding the nav link/page for non-admins too.
- app-base.js (byte-identical across the 3 apps): added
  app.util.revealItem() and the --sw-content-offset sticky-positioning
  variable, carried over from the same round of changes in
  sso-manager-node/proxy. Not yet called anywhere in this app -- no
  sticky/reveal use case here yet -- but keeps the shared file in sync.

nodejs/views/dashboard.ejs

@@ -1,6 +1,7 @@
 <%- include('top') %>
 <script type="text/javascript">app.auth.forceLogin();</script>
 
+<div class="container mt-4">
 <div class="row g-3 mb-4">
 	<div class="col-6 col-md-3">
 		<div class="card shadow-sm text-center"><div class="card-body">
@@ -117,6 +118,7 @@
 		</div>
 	</div>
 </div>
+</div>
 
 <script type="text/javascript">
 	function rows(sel, list){