Improve `/settings/projects` so superusers can navigate sandboxes and projects together

Context

After #4670, /settings/projects is where superusers go to cancel or hard-delete scheduled-for-deletion sandboxes. The page treats sandboxes and root projects identically: flat list, no parent column, single name-search filter. With many sandboxes in a workspace, finding the right row means knowing the name exactly.

Proposal

1. Distinguish sandboxes visually. Either a "Sandbox" badge with the parent name next to it, or a dedicated parent column.
2. Show relationships. Group sandboxes under their root (indent, or sort by root then name).
3. More filters. "Only root projects", "only sandboxes", "only scheduled for deletion".

Notes

• Admin-only page, so the polish bar is lower than user-facing surfaces. The recovery flow lives here though, so it matters when something is wrong.
• Grouping or hierarchy is a bigger UI swing than a badge or filter. Worth a scope conversation before someone picks this up.

Start at the /settings/projects page and inspect the existing projects listing, search, and filter entry points. Resolve whether the scope is visual sandbox distinction, hierarchy, or additional filters before coding; done means superusers can reliably distinguish roots and sandboxes and find scheduled-for-deletion sandboxes.