fix(admin): keep the place search provider reachable on a managed install

The API keys card was hidden wholesale on a managed install, which took
the provider choice with it although the server leaves places_provider
to the admin there. The card stays; the keys, their Save button and the
Google switches fold away, on the phone shell now too. The mobile
warning uses the pending token instead of an undefined one.

The desktop tests find a key input through its labelled toggle rather
than by position, which is where the accessible name sits.

client/tests/helpers/mobileAdmin.ts

@@ -37,6 +37,7 @@ export function buildAdminHook(overrides: Record<string, unknown> = {}): AdminHo
     hour12: false,
     mcpEnabled: false,
     devMode: false,
+    managed: false,
     currentUser: buildAdminUser(),
     updateApiKeys: vi.fn(async () => undefined),
     setAppRequireMfa: vi.fn(),

client/tests/unit/mobile/admin/MAdminSettingsSection.test.tsx

@@ -266,6 +266,17 @@ describe('MAdminSettingsSection', () => {
     expect(admin.handleSaveApiKeys).toHaveBeenCalled();
   });
 
+  it('FE-MOB-ASET-016b: a managed install hides the keys but keeps the provider choice', () => {
+    // The operator owns the credentials; which of them answers place search is
+    // still the admin's call, the same split the desktop tab makes.
+    renderSettings({ managed: true });
+
+    expect(screen.queryByLabelText('Google Maps API Key')).not.toBeInTheDocument();
+    expect(screen.queryByLabelText(/Amap/)).not.toBeInTheDocument();
+    expect(screen.queryByLabelText('Unsplash API Key')).not.toBeInTheDocument();
+    expect(screen.getByDisplayValue('Automatic')).toBeInTheDocument();
+  });
+
   it('FE-MOB-ASET-017: the Google Places toggles persist optimistically', async () => {
     const user = userEvent.setup();
     const seen: string[] = [];