- Move the app display name and a root-access helper onto
RemoteStorageAuthorization, used by both components and the controller,
removing the duplicated fallback chain and the unused OauthHelper includes
- Summarise the card's categories from the union of the app's authorizations'
scopes, so an older token with broader access is not understated
Part of #254