Close the UI-review follow-ups: names typeahead, fleet form, overflow flip.

Staff pages typeahead customers by name (Ada, not cust_1). Add-machine is
two rows with a wide identity path and filename picker. Overflow menus
flip up near the viewport edge. Customer list no longer leaks password
hashes. UI-REVIEW.pdf remaining list is the three leftover items.

packages/zappier/src/admin.ts

@@ -181,7 +181,9 @@ export function adminRouter(
   });
 
   router.get('/customers', (req, res) => {
-    res.json({ customers: customers.list().map((c) => ({ ...c, apiKey: undefined })) });
+    res.json({
+      customers: customers.list().map((c) => ({ ...c, apiKey: undefined, passwordHash: undefined, totpSecret: undefined })),
+    });
   });
 
   router.post('/customers', (req, res) => {