feat(directory): Phase 2 — Roles + Entitlements + Comments

[larsgeorge-db]

Phase 2 of the directory-lookup-and-principal-picker plan (#375). Stacked on #407 — base is feat/directory-frontend so the diff here is Phase-2 only. Will rebase onto main once #406 and #407 land.

Plan: #375
Backend: #406
Phase 1 frontend: #407

Summary

Three multi-principal RBAC surfaces migrated to PrincipalPicker. No backend changes — every existing endpoint accepts the same payload shape it already did.

• Roles form (role-form-dialog.tsx): assigned_groups comma-separated Input → PrincipalPicker(multi, groups). Legacy comma-string records still rehydrate via the new normaliseAssignedGroups helper.
• Entitlements page (entitlements.tsx): persona-group "add" Select with a hard-coded 14-name demo list → PrincipalPicker(multi, groups). The picker renders its own selected-badges so the separate Badge row was dropped. PUT /api/entitlements/personas/{id}/groups payload unchanged.
• Comment composer (comment-sidebar.tsx): audience gains PrincipalPicker(multi, users+groups) alongside (not replacing) the existing Teams + App Roles checkbox lists. Picked users emit as plain emails, picked groups as plain group names; team:* / role:* tokens flow through unchanged. The round-trip is extracted into buildAudienceTokens / parseAudienceTokens.

Helpers added

• lib/audience.ts — parseAudienceTokens(audience) / buildAudienceTokens(parsed) for the mixed-token round-trip.
• lib/assigned-groups.ts — normaliseAssignedGroups(raw) tolerates both string[] and legacy comma-string shapes.

Test plan

• Type-check clean (yarn type-check).
• Lint clean on touched files (0 errors; only pre-existing repo-wide warnings remain).
• Full frontend suite: 562 passed, 6 skipped, 0 failed.
• New tests (12):
  • lib/audience.test.ts (6): split team:/role:/principal mix, defensive guards for null/empty/non-string, prefix-only tokens preserve their empty id, round-trip identity.
  • lib/assigned-groups.test.ts (6): array passthrough, empty-string drop, comma-split + trim, trailing/repeated commas, nullish / non-string-non-array → [], empty string → [].
• Per-page form-dialog tests with the picker rendered inside Radix dialogs remain deferred to Playwright E2E — matches the existing skip convention in this repo (role-form-dialog.test, team-form-dialog.test, project-form-dialog.test, tag-selector.test all skipped for the same Radix-in-jsdom reason). The new helpers cover the load-bearing data transforms.
• Manual smoke test of all three surfaces in both configured + unconfigured modes (left for reviewer / follow-up).

Acceptance criteria from the plan

• Roles: admin can add/remove groups from assigned_groups via the picker; group-membership-based authorization unchanged (no backend changes).
• Roles: pre-existing comma-string assigned_groups records render and save without breakage (covered by normaliseAssignedGroups).
• Entitlements: a persona's group list can be added to / removed from via the picker; same PUT body shape.
• Comments: mixed audience (users + groups + team:* + role:*) round-trips correctly; existing notification fan-out for team/role tokens unaffected (no backend changes; existing parsing in comment renderer preserved).
• Picker tooltips on selected badges expose the underlying email / GUID (carried over from Phase 1 picker).