feat(directory): Phase 1 frontend — Settings tab + PrincipalPicker

[larsgeorge-db]

Second of two PRs implementing Phase 1 of the directory-lookup-and-principal-picker plan (#375). Stacked on #406 — base branch is feat/directory-backend, so the diff here is frontend-only. Will rebase onto main once #406 merges.

Source PRD: #335
Plan: #375
Backend PR: #406

Summary

• Settings → Integrations → Directory tab: provider Select (Entra ID enabled, Okta/Ping rendered disabled so the abstraction is visible to operators), UC HTTP Connection dropdown fed from /api/directory/uc-http-connections, Save / Test / Clear buttons with success/destructive toast feedback, and a provider-specific help block for Entra with the four UC-connection fields plus required Graph application scopes.
• PrincipalPicker — single component, both modes (configured / unconfigured) and both UI variants (inline 2-char-debounced type-ahead + popup "Browse directory" dialog with type-filter chips) selected at runtime from the directory store. Two-line result rows (display name + sub_label), tooltip on selected badges exposing the underlying email/UPN/GUID, X-to-remove. Props are discriminated on multiple so single-pick callers get string | null typing and multi-pick callers get string[] typing without casts.
• directory-store (Zustand) — singleton cache for /api/directory/status so every picker on a page shares one network call, plus a session-sticky degraded flag flipped on the first search failure so subsequent pickers drop straight into manual mode without re-probing.
• Assign Owner dialog migrated to PrincipalPicker(accepts=['user']). API payload (user_email + user_name) is unchanged — the change is purely UI.
• Sidebar entry under Settings → Integrations and /settings/directory route wired up.

Architectural notes

• The picker emits and consumes only the persisted identifier string (UPN/email for users, displayName for groups). Existing storage shapes (str / List[str]) are preserved; no DB migration in v1.
• Pre-existing values render as plain badges with no error decoration regardless of provider availability. The picker does not re-resolve persisted ids against the directory.
• Graceful degradation: if directory.status says configured but a search call fails, the picker logs once (console.warn), flips into manual-entry mode for the rest of the session, and directory-store.degraded becomes sticky so newly-mounted pickers behave the same way.
• Future Phase-2+ migrations (Roles, Entitlements, Comments, etc.) reuse this same component with different multiple / accepts combinations — no per-call-site bespoke control.

Test plan

• Type-check clean: yarn type-check (Done in 17.93s)
• Lint clean on new files (npx eslint ...): 0 errors, only the repo-wide err: any catch-block warning pattern remains (matches existing files).
• Frontend suite: npx vitest run → 550 passed, 6 skipped, 0 failed.
• New tests (19):
  • principal-picker.test.tsx (13): pre-existing values render as plain badges without re-resolving; X-remove emits remaining ids; disabled hides remove buttons; Enter/Tab/comma/blur commit in unconfigured mode; empty / duplicate inputs are no-ops; configured mode calls /api/directory/search with q= and types= honouring accepts; queries < 2 chars do not fire a request; failing search flips into manual-entry mode for the rest of the session.
  • directory-store.test.ts (6): fetchStatus populates state, dedupes concurrent calls into one in-flight request, no-ops once loaded, falls back to not-configured on network failure; refresh re-fetches and clears degraded; markDegraded is sticky.
• Radix Popover dropdown internals are deferred to Playwright E2E — the existing tag-selector tests in this repo follow the same split for the same reason (Radix Popover hangs in jsdom).
• Manual smoke test of the Settings tab + Assign Owner against a real workspace with an Entra UC connection (left for reviewer / follow-up).

What's intentionally not here

• Migration of other principal-bearing fields (Roles, Entitlements, Comments, Teams, Reviews, MDM, etc.) — Phases 2–4 in the plan.
• A production second provider — abstraction is exercised by backend unit-test stub.