Lists the customers holding relations on one app, one cursor page at a time.

            The third-party applications that federate on our OIDC `groups` claim and can therefore
            be administered through a grant here. Each maps to an `external_app` object in the
            authorization graph.
            A closed enum rather than a free-form id on purpose: an arbitrary string would let a typo

write a grant against an object nothing consumes, which looks like access was granted but silently is not. Adding an app is a value here plus a tuple — no model change.This is the app itself; the relation vocabulary defined on these objects is AuthorizationRelations.ExternalApp. The Id suffix here keeps the two distinguishable: a file with using static AuthorizationRelations imports that nested enum, and identical short names would make every bare mention ambiguous.

Relations on an external_app object — one object per third-party app that federates on the OIDC groups claim. The apps themselves are ExternalAppId. The ladder is hierarchical: admin folds into user, and user into viewer. Grants are direct and, like Bidder, are never folded in from platform staff — holding platform admin must not confer administration of a separate system.