Consolidate V2 File Sync admin settings into one card

[Paul Lizer (paullizer)]

Summary

• In V2 Admin Settings, File Sync was split across five separate cards: File Sync with Run limits, Visible Source Types, and one card per workspace type. Nothing linked a workspace type or the source types back to the File Sync switch they depend on. It is now one card.
• Turning on Enable File Sync shows Personal / Group / Public workspaces nested beneath it. Each type that is on gets a collapsible Access panel directly under its own toggle: admins-only, the PersonalFileSyncUser app role, and assigned groups or public workspaces.
• Run limits and Source types (renamed from Visible Source Types) are collapsible panels that apply to every type. When closed, Source types shows how many types are selected (for example 3 selected) instead of 1 setting.
• No settings keys, defaults, validation, or storage change. The classic page's markup is untouched, but ADMIN_NAV is shared, so its sidebar now shows one File Sync link instead of five. This is intentional: V2 now owns its own layout.

Before (5 cards)	After (1 card)

Both screenshots use the same settings: File Sync, all three workspace types, and the group restriction are on, and the Personal and Group Access panels are open. Both were captured from the built SPA with the real field schema.

How it works

• admin_settings_fields.py folds the four sub-sections into file-sync-section. deriveFieldHierarchy works out nesting from depends_on and declaration order, so the three type switches sit together right after the capability switch. Visibility does not chain through dependencies, so every Access field also lists enable_file_sync in its depends_on.
• A new optional group key, anchor (adminFields.ts, adminSections.ts, SettingsSection.tsx), draws a group inside the row of the switch it names.
  • If a search hides the switch, the panel moves to the card body with the label Group workspaces · Access.
  • Each panel button starts with screen-reader-only text naming its switch, so the three "Access" buttons can be told apart.
  • Sections without an anchor render exactly as before.
• describeCollapsedGroup makes a closed group that holds a single checkbox_set show N selected, counted from unsaved edits.
• admin_app_roles.py: "Go to setting" for PersonalFileSyncUser in the role list now goes to file-sync-section.

Worth a careful look

• The classic sidebar loses the four File Sync sub-links. The classic tab was already a single card, and its element ids and deep links still resolve.
• The Access rules control who can open and manage sources. They do not stop scheduled runs of sources that already exist: _is_scheduled_source_allowed re-checks only the group and public assignment lists, not admins-only or the PersonalFileSyncUser role. Review confirmed this while I rewrote the docs. This PR doesn't change that behavior; the docs now describe it accurately. A follow-up could close the gap if scheduled runs should respect those rules too.
• The V2 Redis warning checks only enable_redis_cache. It does not check the URL and key that _is_redis_ready also needs. This was already the case and is now documented.

Linked issue

N/A, no tracking issue for this change.

Release Notes & Latest Features

• New Feature
• Bug Fix
• UI Enhancement
• Breaking Change
• Internal only

Is this visible to end users?

• Yes
• No

Is this admin-facing (Admin Settings, governance, deployment, config)?

• Yes
• No

Should this become a Latest Feature card?

• Yes
• No
• Already added

Screenshot needed for the card?

• Yes
• No
• Attached

Version bump

• application/single_app/config.py VERSION third segment bumped, or not needed because this is docs-only (0.261.259 -> 0.261.260)
• deployers/version.txt bumped, or not needed because deployers/ was not changed

Testing / validation

• npm ci, npm run typecheck, npm run build in application/v2_ui: passed.
• python functional_tests/test_v2_admin_knowledge_file_sync.py: passed, 11/11.
• python functional_tests/test_v2_admin_schema_vocabulary.py: passed, 11/11. I also broke the schema on purpose to confirm the new anchor check catches an Access field missing the File Sync condition and an anchor that names no field.
• python functional_tests/test_v2_admin_section_shell.py: passed, 5/5, including all 37 TypeScript checks in test_v2_admin_section_logic.ts.
• python -m pytest ui_tests/test_v2_admin_file_sync_single_card.py ui_tests/test_v2_admin_settings_wide_layout.py ui_tests/test_v2_admin_agents_visual_hierarchy.py ui_tests/test_v2_admin_model_catalog_workbench.py ui_tests/test_v2_admin_version_status.py: 58 passed. These run the built SPA against the real schema with stubbed APIs, in local Chromium.
• python -m pytest functional_tests/test_docs_app_surface_coverage.py functional_tests/test_docs_site_quality.py functional_tests/test_v2_admin_knowledge_file_sync.py functional_tests/test_v2_admin_schema_vocabulary.py: 35 passed.
• python scripts/check_xss_sinks.py --base-sha 1b8d4c47b --head-sha HEAD <changed application files>: passed.
• python scripts/check_broken_access_control.py --base-sha 1b8d4c47b --head-sha HEAD <changed .py files>: passed.
• git -c core.whitespace=blank-at-eol,blank-at-eof,space-before-tab,cr-at-eol diff --check: passed.
• Wider run of 70 functional test files, each file on its own with python -m pytest <file>. This covers every file that imports the admin schema, navigation, or app-role registry, plus the docs, classic File Sync, and field-contract tests.
  • 55 pass. The other 15 fail the same way on the base commit 1b8d4c47b; I confirmed this by stashing this change and re-running them.
  • Some of those existing failures: test_admin_settings_nav_map (no content-screening pane), test_file_sync_capability (classic template checks), test_v2_admin_settings_schema (the m365_trusted_download_hosts default), several orchestration test files, and test_docs_link_integrity (24 broken links, none in files this PR touches).
• Manual: reviewed screenshots of the built card at 1440px and 390px wide. The UI test also checks for horizontal overflow at 390px and 1920px, with normal and large text, in light and dark themes.

Documentation

• Release notes updated, or not needed (not updated yet; I can add a v0.261.260 entry before merge)
• Feature documentation updated, or not needed:
  • New: docs/explanation/features/V2_ADMIN_FILE_SYNC_SINGLE_CARD.md.
  • Updated: V2_ADMIN_KNOWLEDGE_SETTINGS.md and V2_ADMIN_SETTINGS_LAYOUT_AND_HIERARCHY.md.
  • Rewrote the File Sync section of docs/admin/knowledge.md, replacing placeholder text.
  • Regenerated docs/_data/app_surface.yml.
• Fix documentation updated, or not needed (not a fix)

Security checklist

• New Flask routes include @swagger_route(security=get_auth_security()) (no new routes)
• Settings sent to non-admin frontends use sanitize_settings_for_user() (settings delivery unchanged; admin-only surface)
• Browser JavaScript is served from local SimpleChat static assets only; no CDN-hosted JS (no new assets)
• No secrets, keys, connection strings, or local-only artifacts are included