Auth0 fleet-wide

Authentication events across the whole fleet over the last 48h — real interactive logins, failures, blocks, users, orgs & geo, decoded from Auth0's event-type codes. Auth0 is not per-cluster, so the cluster selector doesn't scope this tab.