feat(16-05): show internal-name fallback in grants matrix column headers (D-04)

- Local Group interface gains internalName?: string | null — GET
  /module-grants/matrix already returns the field (no select on the
  groups query), only the frontend type was missing it.
- Column header text and title tooltip now use internalName ?? name
  (nullish, not truthy) — same fallback pattern as admin/groups and
  UserAccessModal. No layout change: same truncate-with-tooltip cell.
- Search filter now matches both the display name and the stored AD
  name, so neither the internal nor the original AD name search goes
  empty after the header text changed.

apps/web/src/app/(portal)/admin/modules/grants/page.tsx

@@ -16,6 +16,7 @@ interface Module {
 interface Group {
   id: string;
   name: string;
+  internalName?: string | null;
 }
 
 interface GrantPair {
@@ -138,7 +139,10 @@ export default function AdminModuleGrantsPage() {
     [modules, searchLower],
   );
   const filteredGroups = useMemo(
-    () => groups.filter((g) => matches(g.name)),
+    // Matches both the display name (internalName ?? name) and the stored
+    // AD name — a search for either the internal or the AD-original name
+    // must find the group (D-04).
+    () => groups.filter((g) => matches(g.internalName ?? g.name) || matches(g.name)),
     // eslint-disable-next-line react-hooks/exhaustive-deps
     [groups, searchLower],
   );
@@ -206,10 +210,10 @@ export default function AdminModuleGrantsPage() {
                   {filteredGroups.map((g) => (
                     <th
                       key={g.id}
-                      title={g.name}
+                      title={g.internalName ?? g.name}
                       className="sticky top-0 z-10 min-w-[120px] max-w-[160px] truncate border-b border-border bg-card px-4 py-3 text-left text-xs font-medium text-muted-foreground"
                     >
-                      {g.name}
+                      {g.internalName ?? g.name}
                     </th>
                   ))}
                 </tr>