Stage E: split the mixed System Settings card, add the app role roster

[Paul Lizer (paullizer)]

Stage E, the last content change in the Admin Settings rework. Splits the mixed System Settings card and adds the app role roster.

Base: feature/admin-settings-ia. Stacked on #1315.

The mixed card is gone

system-settings-section put five unrelated concerns under one heading. Each moved to the tab that owns it, with the field markup carried across byte-for-byte:

Field	New home
max_file_size_mb	Workspaces → Files & Sharing
conversation_history_limit	Chat → Chat Experience
default_system_prompt	Chat → Chat Experience
access_denied_message	Security → Access & Roles
idle timeout (4 fields)	stays in Security → Session

What remains in Session is only the idle timeout, so the card is renamed idle-timeout-section for what it actually holds. Security → Session was an interim home from #1311; it is now honest.

Splitting a card changes card ids but not field names, which is why the field contract passed unchanged. Card ids are structural and move freely during this work; field names are the breaking surface, and the contract test tracks only those — deliberately.

App Role Requirements roster

Ten settings across seven tabs can each require an Entra app role. You could not read the overall access policy without hunting through the whole of Admin Settings.

Security → Access & Roles now lists every one, with a switch and a link back to the setting in its own tab.

Two things make this safe and durable:

• Built from the page, not from a list. The roster queries input[name^="require_member_of_"] at runtime, so a new role requirement added anywhere appears automatically and this can never fall out of step.
• Mirrors carry no name attribute, following the existing proxy convention, so each setting is still posted exactly once. Sync is two-way — the mirror drives the canonical input and dispatches a change event, and the canonical input updates the mirror when changed on its own tab.

Verified against a simulated DOM:

rows built: 2
labels    : Require CreateGroups App Role | Require WorkflowUser App Role
links     : In Group Workspaces | In Workflow
mirrors carry a name attr: false

mirror on  -> real=true
real off   -> mirror=false

A structural guard worth keeping

test_every_pane_partial_is_balanced checks <div> and <section> balance in every pane.

An unbalanced pane does not fail to render. It silently nests the panes that follow it, so they get hidden and the failure surfaces somewhere completely unrelated. That happened here: a stray </div> in access-roles.html made a Send Feedback test fail. The new test names the offending file directly:

E   jobs.html: 13 <div> vs 12 </div>

Verified against a deliberately broken pane.

The parity test also earned its keep, catching the new roster listed in the nav map in a different order from the markup. Nav order must match pane order.

Result

Navigation is now 14 groups / 44 tabs / 93 sections, from 17 flat tabs.

Check	Result
Field contract	462 names, byte-identical
Regression set (75 files)	32 failures, identical set to baseline
Jinja compile	46/46 admin templates
Pane balance	all panes balanced
XSS sinks	pass

Next

Only cleanup remains: revert the six CI branch filters added so staging PRs would run the gates, then open the staging → Development PR.