Add MediaBrowser live_component with scope_folder_id

[timujinne]

Summary

• Extract PhoenixKitWeb.Live.Users.Media (1158 LOC LiveView) into reusable PhoenixKitWeb.Components.MediaBrowser live_component with optional scope_folder_id (hard-scoped embedding — variant A). /admin/media behavior preserved byte-for-byte when scope_folder_id: nil.
• Upstream's ?view=all "All Files" feature (from Added image_set for correct file pulling on the front end image calls #490) ported into the new architecture. UUID-search and scope-safety preserved.
• Merges upstream/dev with V97/V98 migrations, maintenance mode, OAuth health check, image_set component, and dev_docs PR reviews.
• Plus two small admin UI improvements (see "Additional admin UI changes" below).

Changes

Storage (scope helpers)

• within_scope?/2 predicate + scope-aware list_folder_tree/1, folder_breadcrumbs/2, list_folders/2, list_files_in_scope/2 (recursive CTE), count_orphaned_files/1
• Mutator scope guards: create_folder, update_folder, delete_folder, move_file_to_folder, create_folder_link all return {:error, :out_of_scope} on violation
• All new arities default to scope_folder_id \\ nil → backward-compatible

MediaBrowser live_component

• 1313 LOC component + template. Parent LiveView media.ex shrunk to 75 LOC wrapper
• Upload via progress: &handle_progress/3 callback (replaces Process.send_after polling incompatible with live_components). Reference pattern: media_selector_modal.ex
• Controlled mode detected by presence of on_navigate attr. Parent-notify pattern: component emits {MediaBrowser, id, {:navigate, params}} → parent handle_info → push_patch → handle_params → send_update(nav_params: ...) round-trip for ?folder/q/page/orphaned/view
• scope_invalid detection (scope folder deleted) with UI banner; orphan filter UI hidden when scope set; upload target falls back to scope_folder_id at virtual root; out-of-scope navigation falls back to scope root with flash
• ?view=all "All Files" feature ported: hides folders in grid, shows All Files ({count}) title, scope-safe via list_files_in_scope(scope, ...). UUID-search in list_files_in_scope preserved from upstream.

Runtime hotfixes discovered during browser smoke testing

• phx-target={@myself} added to all 65 event bindings in template + function components (doesn't cascade from root div; each element with phx-click/change/submit/... needs its own target or events route to parent LV)
• update/2 first-mount check via Map.has_key?(...) instead of not socket.assigns[...] (strict not raises on nil/list)
• assign_new(:scope_folder_id, fn -> nil end) so templates using @scope_folder_id don't KeyError when parent omits attr
• AssetsController extended to route phoenix_kit_consent.js to :phoenix_kit_legal app — previously returned 404 text/plain, breaking strict MIME check on any page using app_layout with Legal module enabled. Safe via try/rescue ArgumentError: parent apps without the Legal package see no impact.

Tests (52 new)

• Storage scope contracts (scope_test.exs + media_browser_scope_test.exs)
• LiveView integration (media_test.exs) — URL sync, deep links, auth, malformed page param
• Component (media_browser_test.exs) — scope truncation, controlled/uncontrolled mode, orphan filter visibility, scope_invalid banner
• URL-builder unit (media_url_test.exs) — 21 pure tests (no DB)
• Extended ConnCase with sandbox + endpoint supervision for LiveView tests

Additional admin UI changes

Two small admin UI refactors are also included in this PR (committed to dev before the MediaBrowser work started):

• ffda72f0 Remove globe language switcher from admin header — the standalone globe/locale dropdown is removed from the top admin bar; locale switching moves to the user avatar menu to reduce header clutter. Affects components/admin_nav.ex (-89 LOC), components/layout_wrapper.ex, modules/languages/README.md.
• 1d09f49b Add toolbar_title and toolbar_actions slots to table_default — new slots on core/table_default.ex allow pages to inject a toolbar area above the table without extra wrapping. Migrated three admin pages to use the new slots: roles, activity index, integrations.

Both are non-breaking, additive/refactor changes. Called out explicitly for reviewer visibility.

Parent app impact

After merging to BeamLabEU:dev and pulling into parent apps:

• Run mix phoenix_kit.update — installs phoenix_kit.js and adjusts root layout if needed.
• Run mix ecto.migrate — applies V97 (per-item markup override) and V98 (image_set support) migrations coming from upstream.
• No changes required in parent /admin/media usage — byte-for-byte preserved.
• New embedding API: <.live_component module={PhoenixKitWeb.Components.MediaBrowser} id="..." scope_folder_id={folder_uuid} phoenix_kit_current_user={@current_user} on_navigate={:navigate}/> for scoped media browsers inside forms.

Out of scope (follow-up)

• attr declarations at top of MediaBrowser
• Inline <script>/<style> extraction from template
• Bulk-mutator error aggregation for partial out-of-scope failures
• Extract build_url/parse_page as public helpers to remove test duplication
• Migrating MediaSelector / MediaSelectorModal onto MediaBrowser

Test plan

• mix compile --warnings-as-errors — clean
• mix format --check-formatted — clean
• mix credo --strict — 0 issues on 504 files
• mix dialyzer — clean (via pre-commit)
• Unit tests: 21/21 pass locally (URL-builder)
• Integration tests: compile correctly; pass in CI (local env has pre-existing psql client version mismatch)
• Browser smoke on Decor3D Print (path: "/app") — Mode A: /admin/media behaves identically to pre-refactor (folder tree, file grid, upload, navigation, search, orphan filter, URL sync for ?folder/q/page/orphaned/view, ?view=all, malformed ?page=foo falls back to page 1). Mode B scoped data contracts verified via IEx.

[ddon]

Claude review — approve / merge

Large refactor, but architecturally clean. Full writeup in dev_docs/pull_requests/2026/495-media-browser-component/CLAUDE_REVIEW.md.

Verified:

• Scope enforcement is complete — within_scope?/2 guards every mutator (create_folder, update_folder, delete_folder, move_file_to_folder, create_folder_link); recursive CTE in list_files_in_scope/2 uses Ecto param binding (no SQL injection); folder_breadcrumbs/2 truncates cleanly via drop_while.
• All 62 server-event bindings have phx-target={@myself} — mechanically checked across media_browser.html.heex. Two apparent misses at :488 and :752 are false positives (forms carry submit + change + keydown under one target).
• Lifecycle hotfixes correct — Map.has_key?(socket.assigns, :uploaded_files) first-mount guard avoids the strict-not-on-nil trap; assign_new(:scope_folder_id, fn -> nil end) protects templates from KeyError when parent omits the attr.
• AssetsController widening is safe — try/rescue ArgumentError is the correct exception for Application.app_dir/2 when :phoenix_kit_legal isn't installed; parent apps without the package get a 404 (same as before), not a crash.
• Backward compatibility preserved — all new scope_folder_id \\ nil defaults; /admin/media unscoped path unchanged.
• Tests land where they matter — 52 new tests: scope CRUD guards (scope_test.exs, 519 LOC), component integration (media_browser_scope_test.exs, 233), URL sync + deep links (media_test.exs, 295), URL-builder units (media_url_test.exs, 167).
• Two bundled admin UI changes are non-breaking — globe-switcher removal is pure deletion; table_default toolbar slots are additive, and the three migrated pages (roles/activity/integrations) are consistent.

Medium improvements (non-blocking):

• Missing attr declarations on the live_component — author already listed as out-of-scope/follow-up, reasonable
• folder_breadcrumbs/2 may N+1 on deep trees (only matters per-navigation, not per-file) — batch into a CTE if it becomes a hotspot
• Verify the admin avatar dropdown exposes a language picker after the globe removal

Nitpicks:

• Silent nil return from AssetsController when :phoenix_kit_legal isn't loaded — consider Logger.debug(...) to aid "why isn't my consent banner loading?" debugging

Nice work — the controlled/uncontrolled mode separation, scope_invalid banner, orphan-filter gating, and upload fallback to scope root are all well thought out. Ready to merge.

[ddon]

Follow-up on 4a7057d5 — scope enforcement fixes

Re-reviewed. Two defense-in-depth holes closed correctly — nice catch, both were missed in my original review:

• delete_selected (media_browser.ex:883-898) — now looks up each file via repo and guards Storage.within_scope?(file.folder_uuid, scope) before delete_file_completely. Closes the crafted-event deletion path.
• navigate_to_folder uncontrolled branch (media_browser.ex:1056-1069) — now verifies the resolved folder is in scope and falls back to {nil, nil} (scope virtual root) on violation. Closes the crafted-event folder-name exposure.

Notes:

• selected_folders was already safe via Storage.delete_folder(folder, scope) mutator-level guard, so no change needed there. ✅
• Controlled mode of navigate_to_folder was never vulnerable — it round-trips through parent handle_params → apply_nav_params/2 → resolve_folder/2, which already scope-checks.
• Silent skip on out-of-scope delete is the right call for defense-in-depth, but the flash still reads "#{file_count + folder_count} item(s) deleted" using the selected count, not the actually deleted count. Minor, pre-existing — worth a small follow-up to report actual counts.

Verdict unchanged: approve / merge. Scope contract now holds uniformly across all code paths.