List shadow-mode prompt-capture scopes (platform admin)

Every scope currently on the config table, including a stale one an operator forgot to disable (still visible here; expiresAt tells the operator whether the gateway is still honoring it, an expired-but-not- yet-swept row is inert even though it's still listed).