Add accessible workflow visual authoring (M5B)

[Paul Lizer (paullizer)]

Summary

• M5A provided read-only Flow inspection, so authors still needed List for semantic edits. M5B lets authorized users edit the same opt-in definition-v3 draft from List or Flow without introducing another executable graph or runtime.
• Shared immutable commands and configuration forms cover tasks, If/else, routing, For each, Repeat until, Collect, and typed bindings/outputs. Raw field buffers survive surface changes. Reference-breaking edits require confirmation and retain exact selectors for repair rather than silently retargeting consumers.
• Compiler previews display execution arrows only for the exact valid candidate. Original CAS, scope, active-run, and Save protections remain intact. Dragging is layout-only; saved/run Flow stays read-only. Keyboard/mobile controls preserve focus, scrolling, and native browser zoom.
• Bumps the application to 0.261.122 and adds the completed-M5B handoff and M5C undo/redo plan. M5C is planning only. Backend compiler/runtime, routes, publication/export behavior, dependency pins, and deployers are unchanged.

Review detail: preview serialization omits opaque saved/runtime metadata but retains every server-authored revision field; Save preserves the original envelope. Cross-language tests verify field-list, digest, and compiler parity. The shared canvas also handles native zoom gestures before the pinned library's cancellation handler.

Linked issue

N/A - no associated issue; the owner chose session-only tracking.

Builds on merged M5A #1505. Target branch: paullizer-react-v2-ui.

Release Notes & Latest Features

• New Feature
• Bug Fix
• UI Enhancement
• Breaking Change
• Internal only

Is this visible to end users?

• Yes
• No

Is this admin-facing (Admin Settings, governance, deployment, config)?

• Yes
• No

Should this become a Latest Feature card?

• Yes
• No
• Already added

Deferred to the owner's O6 announcement decision. No card has been published.

Screenshot needed for the card?

• Yes
• No
• Attached

N/A until the card decision. No screenshots or other media are published by this PR.

Version bump

• application/single_app/config.py VERSION third segment bumped, or not needed because this is docs-only
• deployers/version.txt bumped, or not needed because deployers/ was not changed

Application: 0.261.121 -> 0.261.122. No deployer changes.

Testing / validation

Completed offline during implementation; selections overlap and are not a repository-wide or live-Azure acceptance claim.

• npm --prefix .\application\v2_ui run typecheck and npm --prefix .\application\v2_ui run build: passed.
• node --test .\functional_tests\test_workflow_flow_authoring_commands.js .\functional_tests\test_workflow_field_drafts.js .\functional_tests\test_workflow_flow_semantics.js .\functional_tests\test_workflow_execution_inspection_client.js: 84 passed.
• Authoring/compiler and selected existing schema/digest contracts: 67 passed, 209 deselected. Exact command is recorded in the handoff.
• With PLAYWRIGHT_SERVICE_URL empty, python -m pytest -q .\ui_tests\test_v2_workflow_flow_authoring.py .\ui_tests\test_v2_workflow_flow_inspection.py: 82 passed (30 authoring, 52 M5A), including buffer retention, exact Save payload/CAS, stale-preview/access isolation, pending Save, Escape, and native wheel/pinch behavior.
• Additional selections: 140 legacy editor/publication browser passes; 57 backend inspection/policy/layout passes; 11 targeted compiler/CAS/runtime/export/publication passes, including a real 1,000-round batch followed by admitted lifetime round 1,001.
• Structured/Repeat/loop browser compatibility: 172 initial passes; two tests updated for the intentional Move-confirmation interaction then passed their focused rerun. The pre-existing test_revoked_record_refresh_clears_the_previous_page case remains explicitly excluded as O5; restricted-data clearing assertions are preserved elsewhere.
• python .\functional_tests\test_v2_ui_local_assets.py: 4/4. Flow asset tests: 4 passed plus 25 subtests. Documentation coverage: 7/7; site quality: 6/6. JS syntax, scoped XSS/BAC guards, and whitespace checks passed. The XSS scanner does not classify TSX.

Reproduction commands and limitations are in docs\explanation\features\WORKFLOW_M5B_COMPLETION_AND_NEXT_STEPS.md. No live workflow, model, publication, or deployment was performed.

Documentation

• Release notes updated, or not needed
• Feature documentation updated, or not needed
• Fix documentation updated, or not needed

Added M5B feature documentation and updated the related Flow/structured-flow documentation and create/trigger guides. Added and clarified the M5C planning handoff. No separate fix document is needed for this feature slice. The generated surface inventory was verified current with no content delta.

The 0.261.122 release-note entry remains intentionally pending owner approval under O6. O1-O9, the cumulative spend cap, and live acceptance remain separately scoped; they are not implemented by this PR.

Security checklist

• New Flask routes include @swagger_route(security=get_auth_security())
• Settings sent to non-admin frontends use sanitize_settings_for_user()
• Browser JavaScript is served from local SimpleChat static assets only; no CDN-hosted JS
• No secrets, keys, connection strings, or local-only artifacts are included

Routes/settings items are N/A: neither was changed. Existing server authorization and concurrency checks remain authoritative. Generated bundles, dependencies, and local browser artifacts are excluded.