CELDEV-1338 - Add router-independent admin frontend islands

[fpichler]

Summary

• make PageAttachments router-independent through a reusable typed feature, thin SPA adapter, and guarded <cel-page-attachments> island
• keep one isolated Pinia/runtime instance per mount and preserve existing server-rendered URLs, wrappers, and asynchronous fragment loading
• pass independent canUpload and canDelete capabilities from Velocity through the custom element into VueFinder while retaining backend authorization
• restore attachment revision-history access through the backend-provided historyUrl
• preserve anonymous public-document listing through explicit guest VIEW-right evaluation in the backend dependency
• retain typed selection/action extension contracts for downstream consumers

Stylesheet and package contract

• use Tailwind v4 prefix(tw) with important source(none) and migrate all application utilities to the tw: prefix
• retain scoped application/vendor CSS and light-DOM teleport styling without leaking resets into legacy host markup
• publish only dist/package and dist/types; dedicated pack-manifest validation excludes dist/assets and dist/.vite
• remove unused runtime dependencies and keep build-only Tailwind integration in devDependencies
• keep ADR 0001 focused on durable feature/island architecture and light-DOM decisions

npm delivery

• consume the reusable npmPackagePipeline(appDir: 'celements-admin-frontend') shared-library step
• remove the repository-local Forge publication script
• retain immutable snapshot versions, exact package-derived release tags, overwrite protection, credential isolation, and registry error handling in the shared pipeline

Dependencies

• synventis/server-tools#93 / INFRA-479: reusable Jenkins npm publication pipeline
• celements/celements-base#314: backend historyUrl and guest-rights contract

Both dependency threads remain open until the changes are merged and available to the consuming environments.

Validation

• npm ci — passed
• npm run publish:check — passed; 20 unit tests passed, one environment-gated pack test skipped in the normal suite
• dedicated pack-manifest test — passed
• npm run lint — passed
• npm run format — passed
• frontend type-check and deployable/package/type builds — passed
• PageAttachmentsControllerTest in the backend dependency — 7 tests passed
• backend dependency clean compile and local 7.2-SNAPSHOT installation — passed
• shared-pipeline Groovy parser/compiler and git diff --check — passed
• zero frontend/test function-declaration residue check — passed
• mvn -U -f celements-webapp/pom.xml -DskipTests compile — blocked before compilation by the existing unmanaged com.celements:celements-navigation-rest dependency at celements-webapp/pom.xml:225; refreshing snapshot metadata does not resolve the missing version

Manual deployed-environment verification remains pending for anonymous listing, independent EDIT/DELETE affordances, exact revision-history navigation, legacy attachment surfaces, and teleport styling.

Jira: https://synjira.atlassian.net/browse/CELDEV-1338

[msladek]

Jenkinsfile.npm and publish-forge-package.sh contain mostly reusable npm-specific publication workflow logic. Please move this into a focused npmPackagePipeline in the server-tools Jenkins shared library, analogous to dockerImagePipeline, and keep this repository’s pipeline declarative:

 @Library('synventis') _
npmPackagePipeline(appDir: 'celements-admin-frontend')

[fpichler]

Agreed. I moved the reusable publication workflow into npmPackagePipeline in server-tools, tracked by INFRA-479 and synventis/server-tools#93. This repository now uses the declarative npmPackagePipeline(appDir: 'celements-admin-frontend') call, and the repository-local publication script has been removed.

[msladek]

Preserve anonymous attachment listing

Replacing the server-rendered template with the Vue island affects normal document views, the attachments page, and the attachment overlay—not only editors. The previous template listed attachments, metadata, history, and download links for all viewers while restricting upload and delete actions to users with edit/admin rights. The island loads this list through PageAttachmentsController, whose prepareRequest() returns 401 when no authenticated user exists before evaluating VIEW rights. Anonymous users therefore lose the attachment listing on public documents despite having VIEW access.

[fpichler]

Confirmed the regression risk. checkAuth() itself does not cause the 401, but the subsequent explicit null-user branch does. I removed that branch so anonymous requests are evaluated as XWiki.XWikiGuest through the normal VIEW-rights check. celements/celements-base#314 adds tests for both allowed and denied anonymous listing; denied access returns 403.

[msladek]

The replaced attachmentsinline.vm linked each attachment’s version to the viewattachrev action. The new VueFinder UI sets history: false and exposes no equivalent link. The action itself remains functional, but users can no longer reach attachment revision history from the attachment listing.

[fpichler]

Addressed through celements/celements-base#314. Attachment responses now contain an explicit backend-generated historyUrl, and PageAttachments provides a localized per-file revision-history action that navigates to that exact URL. VueFinder’s history feature controls directory navigation rather than attachment revisions, so it remains disabled.