Consolidate auth patterns in developer apps show view

The developer apps show view uses two different authorization mechanisms side by side:

- `admin?` (controller helper) for display logic like showing the owner name and linking collaborator emails to backend
- `policy(@app).manage_collaborators?` (Pundit policy) for the collaborators section

These are conceptually similar checks but use different patterns. Should pick one approach — ideally Pundit policies throughout — so authorization is consistent and testable in one place.