Make Live Activities Remote tokens app-wide instead of competition-scoped

## Problem
Competition Groups wants a single "Sign in to Live Activities Remote" session to apply across all competitions the user can manage. The frontend now treats NotifyComp Remote auth as an app-wide session, but the token minted by Competition Groups currently includes a `competitionIds` claim populated from the competition used during sign-in plus managed upcoming/ongoing competitions.

That creates an awkward contract for NotifyComp: either the API has to treat the token as app-wide and authorize each competition from the WCA user identity, or users may hit auth failures when opening a manageable competition that was not included in the token claim at sign-in time.

## Desired behavior
A NotifyComp Remote token should represent the user's app-wide Remote session. For each remote GraphQL operation, NotifyComp should authorize the requested competition against the token's WCA user identity and current competition manager/delegate permissions, not against a stale frontend-provided competition list.

## Why
- Users expect one NotifyComp login to work across all competitions they manage.
- Competition manager access can change after token minting.
- Competition Groups should not need to re-auth just because a user moves from one competition's Remote page to another.

## Current related code
In Competition Groups, `netlify/functions/notify-comp-token.js` currently includes `competitionIds` in the JWT for `notifycomp.remote` tokens and notes that NotifyComp must reject remote mutations outside that claim.

## Acceptance criteria
- Remote tokens are documented/implemented as app-wide sessions.
- NotifyComp authorizes remote operations per requested competition using WCA user identity/permissions, or exposes a replacement contract that supports app-wide login cleanly.
- Competition Groups no longer needs a competition-scoped auth check for Remote sign-in state.