I think this is a grey line, which is very difficult, especially as she's autistic.
I mean, I have an old Butlin's keycard. I realised I had it about 50 miles down the road. It didn't feel worth posting back, so I decided I'd take it back the next year when we stayed, and just pop it in with the rest of them when we signed out.
When we got there the next year, they'd changed the style of the cards, so I didn't.
So in the great scheme of things, I don't think the hotel is going to be fussed at all. If you'd found a manager, you might have even found they were happy to deactivate the card and let her take it home.
But it is setting a potential precedent as she admits she did it on purpose. She didn't tell you before you left because she thinks you would have said "no", so she knows that she shouldn't have done it.
If she'd told you it was an accident, then it would be different.
Even if you do it as a "they won't notice" you're then potentially setting up a rule for her that it doesn't matter if they have lots/won't notice/something small.
I would get her to write a letter explaining that she took it and why, and put the card in it. An alternative would be phone up (ideally get her to, but I suspect that would be beyond her) with her next to her, and explain that she took it, and ask if they would like her to send it back, or could she buy it for £1 or similar. I suspect they'll say keep it, but then she knows she has permission, which I think could be important for her to understand.