Make Live Activities Remote tokens app-wide instead of competition-scoped

[coder13]

Problem

Competition Groups wants a single "Sign in to Live Activities Remote" session to apply across all competitions the user can manage. The frontend now treats NotifyComp Remote auth as an app-wide session, but the token minted by Competition Groups currently includes a competitionIds claim populated from the competition used during sign-in plus managed upcoming/ongoing competitions.

That creates an awkward contract for NotifyComp: either the API has to treat the token as app-wide and authorize each competition from the WCA user identity, or users may hit auth failures when opening a manageable competition that was not included in the token claim at sign-in time.

Desired behavior

A NotifyComp Remote token should represent the user's app-wide Remote session. For each remote GraphQL operation, NotifyComp should authorize the requested competition against the token's WCA user identity and current competition manager/delegate permissions, not against a stale frontend-provided competition list.

Why

• Users expect one NotifyComp login to work across all competitions they manage.
• Competition manager access can change after token minting.
• Competition Groups should not need to re-auth just because a user moves from one competition's Remote page to another.

Current related code

In Competition Groups, netlify/functions/notify-comp-token.js currently includes competitionIds in the JWT for notifycomp.remote tokens and notes that NotifyComp must reject remote mutations outside that claim.

Acceptance criteria

• Remote tokens are documented/implemented as app-wide sessions.
• NotifyComp authorizes remote operations per requested competition using WCA user identity/permissions, or exposes a replacement contract that supports app-wide login cleanly.
• Competition Groups no longer needs a competition-scoped auth check for Remote sign-in state.