web: label the GA annotation lane as internal, with a visibility badge

"Autopilot Monitor Team" read like a vendor-to-customer message channel.
The lane only ever renders for platform-scope users, so it now says
"Internal (Autopilot Monitor)" and carries a "never visible to the
tenant" badge on the session card.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/Web/autopilot-monitor-web/app/sessions/components/SessionAnnotationsCard.tsx

@@ -212,6 +212,14 @@ export default function SessionAnnotationsCard({
             <div key={lane} className="border border-gray-200 rounded-lg p-4">
               <div className="flex items-center flex-wrap gap-2 mb-2">
                 <span className="text-sm font-medium text-gray-900">{LANE_LABELS[lane]}</span>
+                {lane === "globaladmin" && (
+                  <span
+                    className="inline-flex px-2 py-0.5 rounded-full text-xs font-medium bg-violet-50 text-violet-700"
+                    title="This lane is platform-internal: it is filtered out of every tenant response server-side."
+                  >
+                    never visible to the tenant
+                  </span>
+                )}
                 {annotation?.verdict != null && !writable && (
                   <span
                     title={VERDICT_DESCRIPTIONS[annotation.verdict as AnnotationVerdict]}

src/Web/autopilot-monitor-web/app/sessions/components/sessionAnnotationLogic.ts

@@ -68,7 +68,10 @@ export const VERDICT_PILL_CLASSES: Record<string, string> = {
 export const LANE_LABELS: Record<AnnotationLane, string> = {
   operator: "Operator",
   tenantadmin: "Tenant Admin",
-  globaladmin: "Autopilot Monitor Team",
+  // Only ever rendered for platform-scope users — the backend filters this lane out of
+  // every tenant response. The label must read as INTERNAL, not as a message channel
+  // from the vendor to the customer.
+  globaladmin: "Internal (Autopilot Monitor)",
 };
 
 /**