Web UI: feature updates across all modules

Broad UI improvements spanning auth, branding, notifications, agents, analytics,
approvals, audit-log, bundles, configuration, console-admin, dashboard,
deployments, doctor, environments, evidence, feed-mirror, graph, integration-hub,
issuer-trust, lineage, notify, offline-kit, policy, promotions, quota, registry,
release-orchestrator, releases, sbom, scans, secret-detection, security, settings,
setup-wizard, system-health, topology, triage, trust-admin, unknowns, vex-hub,
vulnerabilities, and watchlist features.

Adds new shared components (page-action-outlet, stella-action-card, stella-form-field),
scripts feature module, audit-trust component, e2e test helpers, and release page
e2e specs. Updates auth session model, branding service, color tokens, form styles,
and i18n translations.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/Web/StellaOps.Web/e2e/helpers/seed-releases.ts

@@ -0,0 +1,87 @@
+/**
+ * Seed + cleanup helpers for release e2e tests.
+ *
+ * Inserts deterministic rows into:
+ *   release.control_bundles
+ *   release.control_bundle_versions
+ *   release.control_bundle_materialization_runs
+ *
+ * Uses docker exec to run psql against the compose postgres container.
+ */
+
+import { execSync } from 'node:child_process';
+
+const TENANT_ID = '3a5e72b6-ae6a-f8a4-2b6a-df2960d63016';
+
+// Deterministic UUIDs for seeded entities
+const BUNDLE_API_GW   = 'e2e00001-0001-4000-a000-000000000001';
+const BUNDLE_AUTH_SVC  = 'e2e00001-0002-4000-a000-000000000002';
+const BUNDLE_HOTFIX   = 'e2e00001-0003-4000-a000-000000000003';
+
+const VERSION_API_GW  = 'e2e00002-0001-4000-a000-000000000001';
+const VERSION_AUTH_SVC = 'e2e00002-0002-4000-a000-000000000002';
+const VERSION_HOTFIX  = 'e2e00002-0003-4000-a000-000000000003';
+
+const RUN_01 = 'e2e00003-0001-4000-a000-000000000001';
+const RUN_02 = 'e2e00003-0002-4000-a000-000000000002';
+const RUN_03 = 'e2e00003-0003-4000-a000-000000000003';
+const RUN_04 = 'e2e00003-0004-4000-a000-000000000004';
+const RUN_05 = 'e2e00003-0005-4000-a000-000000000005';
+
+function psql(sql: string): void {
+  const escaped = sql.replace(/'/g, "'\\''");
+  const cmd = `docker exec stellaops-postgres psql -U stellaops -d stellaops_platform -c '${escaped}'`;
+  execSync(cmd, { stdio: 'pipe', timeout: 15_000 });
+}
+
+/**
+ * Insert seed data for release e2e tests.
+ * Safe to call multiple times (uses ON CONFLICT DO NOTHING).
+ */
+export function seedReleaseData(): void {
+  // 1. Bundles
+  psql(`
+    INSERT INTO release.control_bundles (id, tenant_id, slug, name, description, created_by)
+    VALUES
+      ('${BUNDLE_API_GW}',  '${TENANT_ID}', 'e2e-api-gateway',   'e2e-api-gateway',   'E2E test bundle: API Gateway',   'e2e-seed'),
+      ('${BUNDLE_AUTH_SVC}', '${TENANT_ID}', 'e2e-auth-service',  'e2e-auth-service',  'E2E test bundle: Auth Service',  'e2e-seed'),
+      ('${BUNDLE_HOTFIX}',  '${TENANT_ID}', 'e2e-hotfix-patch',  'e2e-hotfix-patch',  'E2E test bundle: Hotfix Patch',  'e2e-seed')
+    ON CONFLICT DO NOTHING;
+  `);
+
+  // 2. Versions (one per bundle, published)
+  psql(`
+    INSERT INTO release.control_bundle_versions
+      (id, tenant_id, bundle_id, version_number, digest, status, components_count, changelog, published_at, created_by)
+    VALUES
+      ('${VERSION_API_GW}',  '${TENANT_ID}', '${BUNDLE_API_GW}',  1, 'sha256:e2eaaa111', 'published', 4, 'Initial API Gateway release',  NOW(), 'e2e-seed'),
+      ('${VERSION_AUTH_SVC}', '${TENANT_ID}', '${BUNDLE_AUTH_SVC}', 1, 'sha256:e2ebbb222', 'published', 3, 'Initial Auth Service release', NOW(), 'e2e-seed'),
+      ('${VERSION_HOTFIX}',  '${TENANT_ID}', '${BUNDLE_HOTFIX}',  1, 'sha256:e2eccc333', 'published', 1, 'Emergency hotfix patch',       NOW(), 'e2e-seed')
+    ON CONFLICT DO NOTHING;
+  `);
+
+  // 3. Materialization runs
+  psql(`
+    INSERT INTO release.control_bundle_materialization_runs
+      (run_id, tenant_id, bundle_id, bundle_version_id, status, target_environment, reason, requested_by)
+    VALUES
+      ('${RUN_01}', '${TENANT_ID}', '${BUNDLE_API_GW}',  '${VERSION_API_GW}',  'running',   'prod-us-east', 'Pending approval: prod deploy',       'e2e-admin'),
+      ('${RUN_02}', '${TENANT_ID}', '${BUNDLE_AUTH_SVC}', '${VERSION_AUTH_SVC}', 'running',   'prod-eu-west', 'Pending approval: EU deployment',     'e2e-admin'),
+      ('${RUN_03}', '${TENANT_ID}', '${BUNDLE_HOTFIX}',  '${VERSION_HOTFIX}',  'queued',    'staging',      'Pending: staging validation',         'e2e-admin'),
+      ('${RUN_04}', '${TENANT_ID}', '${BUNDLE_API_GW}',  '${VERSION_API_GW}',  'succeeded', 'staging',      'Approved: staging deployment passed', 'e2e-admin'),
+      ('${RUN_05}', '${TENANT_ID}', '${BUNDLE_AUTH_SVC}', '${VERSION_AUTH_SVC}', 'failed',    'prod-us-east', 'Rejected: gate policy violation',     'e2e-admin')
+    ON CONFLICT DO NOTHING;
+  `);
+}
+
+/**
+ * Remove all e2e seed data (rows with e2e- prefix bundles).
+ * Cascades via FK delete rules on versions + runs.
+ */
+export function cleanupReleaseData(): void {
+  psql(`
+    DELETE FROM release.control_bundles
+    WHERE tenant_id = '${TENANT_ID}'
+      AND slug LIKE 'e2e-%';
+  `);
+}