March 22 QA Release: Admin/Vendor/Mail Fixes and Dev-to-QA Promotion

This release promotes the dev branch to the QA environment, carrying a large batch of work (the PR description cites ~260 commits across 60+ feature PRs: IAM auth migration, the entity-to-tenant rename, WebSocket real-time updates, and admin/vendor portal parity). The final set of changes merged here hardens system-record protection in the admin portal, fixes document and comment counts in the mail app, and resolves several vendor upload and file-viewing issues.

QA needs a consolidated, testable build of recent development work before any production promotion. Beyond the bulk promotion, the closing fixes address concrete defects: system folders/rules could be edited, deleted, or bulk-deactivated despite backend protections; tenant table sorting was applied only to the current page instead of the full dataset; sidebar document counts ignored the active tab; batch/mail comments vanished when the drawer was reopened; modals dismissed on accidental outside clicks; and a "Clear Completed" button called a backend endpoint that does not yet exist (returning 404).

Administrators get correct, consistent behavior: system folders and rules can no longer be accidentally modified or removed (via row menus, view dialogs, or bulk actions), and tenant lists sort correctly across all pages. Mail users see accurate per-tab document-type counts and no longer lose comments when reopening the comments drawer. Vendor users regain the "Download Parent ZIP" action, get a working FileStack upload picker sidebar, see ZIP "View" open a file-details page instead of downloading a raw binary, and no longer encounter the broken "Clear Completed" button. Modals across mail no longer close on stray outside clicks.

Grounded in the merge diff (frontend monorepo, ~299 additions / 171 deletions across 25 files):

• Admin – system-record guards: folders/page.tsx and rules/page.tsx hide/disable Edit, Delete, Activate/Deactivate, and bulk handlers for is_system records (with tooltips and checkbox filtering).
• Admin – server-side sorting: data-table.tsx adds controlled sorting/onSortingChange (manualSorting); tenants/page.tsx maps column keys to backend sort_by/sort_order and resets to page 1 on sort change.
• Mail – document counts: documents/page.tsx, usePaginatedDocumentTypes.ts, and the document-types service/query thread a new exclude_status_ids param so the In Progress tab counts non-completed docs.
• Mail – comments cache: useCommentsDrawer.ts adds workspaceSignature to the query key and invalidates the comments cache after create/reply.
• Modal dismissal: apps/mail/.../dialog.tsx and packages/ui/.../dialog.tsx add onInteractOutside preventDefault.
• Vendor: restored "Download Parent ZIP" in FilesTab; ZIP View now opens /files/{parent_zip_mail_id}; FileStack picker overflow fixes (globals.css, CloudUploadTab, UploadModal); mobile-only header sidebar trigger; removed the unimplemented Clear Completed button, route, service, mutation, and type; type updates adding parent_zip_mail_id/parent_zip_contents_url.

Medium risk due to the large surface of the underlying dev-to-qa promotion (auth, tenant rename, WebSockets) rather than the closing fixes, which are small and targeted. The dialog onInteractOutside change is global in the shared UI package and could feel like a regression if any flow relied on click-outside to close. Server-side sorting depends on the backend honoring the mapped sort_by fields, and the document-count fix depends on backend support for exclude_status_ids. Mitigation: this is a QA-only release for full regression before any production promotion; the removed Clear Completed feature is tracked against backend ticket DSM_Backend_dev#120.

• Admin folders/rules: confirm system records cannot be edited, deleted, deactivated, or selected (row menu, view dialog, and bulk actions); verify tooltips show.
• Tenant table: sort each sortable column and confirm ordering is correct across multiple pages and resets to page 1.
• Mail documents: switch between In Progress and Completed tabs and verify sidebar counts match grid contents.
• Comments: add comments/replies on a batch or mail, close and reopen the drawer, and confirm they persist; verify across workspaces.
• Modals: confirm dialogs across mail no longer close on outside click but still close via explicit controls.
• Vendor: verify Download Parent ZIP appears and works for extracted files; ZIP View opens the file-details page; FileStack picker sidebar (Link/URL input) is fully visible; mobile vs desktop sidebar toggle; confirm no Clear Completed button or 404.
• Run the broader dev-to-qa smoke tests in the PR test plan (IAM login/logout, tenant rename consistency, WebSocket real-time updates).