[pull] master from mattermost:master - #929

… New attribute (#38002)

* [MM-69866] Add Applies-to resource picker (Users, Channels, Posts) to New attribute

Adds an "Applies to" Card to the Global Attributes "New attribute" page,
letting a sysadmin pick which resources (Users, Channels, Posts) an
attribute applies to before saving. Each selected resource becomes its
own linked PropertyField, created serially after the template so a
partial failure can be attributed to a specific resource and rolled
back deterministically (linked fields deleted before the template,
per the server's deletion-order protection).

A `user`-scoped linked field shares its namespace with Custom Profile
Attributes, so name conflicts and the shared 20-field cap are newly
reachable failure modes -- both get distinct, actionable banners
instead of a generic failure message.

Client-only change; no server, migration, or Client4 changes required.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* Split the Applies-to row into one component per resource type

Replaces the single resourceType-parameterized AttributeAppliesToItem
with three dedicated components (User/Channel/Post), each hardcoding
its own icon, label, and testids instead of looking them up by a prop.
All three share one prop signature (AttributeAppliesToItemProps,
exported from attribute_applies_to_constants.tsx) so the parent's
Record<ResourceObjectType, ComponentType<...>> lookup map fails to
compile if any of the three drift from it.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* Fix Prettier formatting in the global_attributes E2E files

npm run check for e2e-tests/playwright runs lint && prettier && tsc,
and CI's prettier --check step was failing on both files -- they'd
only been checked against webapp's ESLint config locally, not this
package's Prettier config.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* Move the Applies-to row's Remove action into the expanded state

The collapsed row no longer has any remove affordance -- the only way
to remove a resource is to expand it first, then click "Remove
resource" in the header (still a sibling of the toggle, not nested
inside its clickable area). Styled per the design prototype: a plain
text button, transparent by default, --error-text colored, with a
rgba(--error-text-color-rgb, 0.08) hover tint -- the same pattern
already used by OrphanedFieldDeleteButton (system_properties) rather
than a new one-off style.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* Add 12px right margin to the Applies-to row's Remove button

Matches the design prototype's spacing between the button and the
row's right edge.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* Rename applies-to constants file to .ts

The file has no JSX, so the .tsx extension was misleading.

* Polish the Applies-to card empty state and expanded rows

Match the design: updated copy and type, primary/tertiary add buttons, header-only open tint, and a 176px form row in the expanded body.

* Drop bottom padding on the last Applies-to body row

It stacked with the container padding and looked doubled.

* Size Unique name label, value, and Edit to 12px

The caption and Edit link were 14px against a 12px label; shrink the edit input to match.

* Treat Unique name click-away as Done

Opening Edit then clicking away left the input open and froze auto-derivation. Blur now uses the same commit path as Done, matching the channel URL field.

* Lock Type to Text while an external source is linked

LDAP and SAML only sync on text fields; disabling the type menu until the last chip is removed keeps that invariant in the UI.

* Show linked sources on the Options line as Synced with chips

Once a source is selected the chips replace the Text help copy; the divider stays until then so the unlinked state still separates Options from the add-source trigger.

* Order flex container properties to satisfy stylelint.

* Show CPA banners only for Users and copy leftover-template rollback.

Channels and Posts name conflicts used User Attribute wording, and a leftover template after a linked-field rollback looked like a clean save. E2E cleanup now rediscovers template and linked fields instead of relying on the success-path list.

* Use Compass Button for Applies-to row chrome.

Override quaternary styling so the accordion header stays body-text chrome, and keep Remove as tertiary destructive.

* Await hanging creates before unmount-save negative asserts.

waitFor(() => Promise.resolve()) returns on the first check and can pass before finalizeSave, so the mount guard was not actually load-bearing.

* Drop unused PropertyField and ResourceObjectType imports from the Playwright spec.

---------

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
Co-authored-by: Mattermost Build <build@mattermost.com>

* MM-69323 Enable Concurrent React

* Fix Cypress tests involving post dot menu

* Fix flaky Cypress tests involving Team Settings modal

* Fix setState in permissions code when called twice in rapid succession by tests

* Update fullname_spec.js to wait for suggestion list to close

This is needed because the setState in SuggestionBox.clear isn't processed until
after the Enter keypress registers. Alternatively, we could wrap that in flushSync,
but since this seems to only occur during testing, I decided not to change
the web app code.

* Update more E2E tests

* Fix accidental commented test code

* Switch useContainerDimensions to useLayoutEffect to fix newly introduced layout shift

* Skip post_height SVG test on all browsers and message attachment test on Firefox

* Bump changes to feature flag for a future PR

* Enable concurrent React in E2E tests

* Change test password to mostest_password

This makes the password compliant with the 112 bits minimum length
requirement. Otherwise, FIPS-compliant OpenSSL implementations will
panic when trying to connect from `lib/pq` with a shorter password.

* Simplify test templates' POSTGRES_PASSWORD values

* make generated

* Modify missing "mostest" strings