What will restore the Connected Status without using the Connected App?
I'm not sure what you mean by "without using the Connected App" as all authorization needs to go through a connected app.
I'm assuming you mean without adding the Admin Profile to the connected app. You need to have some pre-approved setting on the JWT connected app. Instead of using the Admin Profile, I usually recommend using a permission set. If you look at the JWT connected app policy settings, you can add a permission set there or create a new one and just assign it to the user you are trying to use for CI.
What is the connection between the authorization granted by web login and by JWT grant?
The connected app. By default, the web login uses an SFDX connected app. That is the app you approve the first time you go through the web login flow. You can also use the JWT connected app (or a different custom connected app) by using the --clientid flag on the auth:web:login.
Another difference is the web:login uses a web oauth flow where you sign in through the browser and the browser will return an auth code that the CLI can exchange for a refresh token, and in turn get an auth token. The JWT flow, however, uses a JWT crt/key to get the auth token, so there is no refresh token.