Mail App: Internal-Tenant Scope Toggle, Smarter Folder & Upload-Center Controls (QA)

A batch of Mail application improvements has been promoted to the QA environment. Headlining the release is a new "Include Internal" workspace toggle that lets system-level users pull internal-tenant data into their view on demand, alongside safer folder activation controls, a reworked Upload Center picker, and several stability fixes to the workspace and enterprise selectors.

System-level operators previously had no way to optionally widen their workspace to include internal (system-owned) tenant data, and the existing workspace, enterprise, and upload-center selectors had usability and reliability gaps — stale dropdown options after changing the workspace owner, an occasional runaway API loop when a search returned no results, detail-page tabs that collapsed into a broken layout on smaller screens, and a risk of deactivating protected system folders.

• System users can tick "Include Internal" to merge internal-tenant results into their workspace scope, and untick it to return to their normal view; the choice is remembered between sessions and respects permission changes.
• The Enterprise (subclient) list now refreshes correctly whenever the Workspace Owner changes, removing stale options.
• The Upload Center picker now supports search, a running result count, and infinite-scroll paging, and can be narrowed to a single selected enterprise.
• Folder rows now show the correct Activate/Deactivate action for their status, and system-protected folders can no longer be deactivated (with a clear tooltip and warning).
• Detail-page tabs stay on one row with horizontal scroll on narrow screens instead of wrapping awkwardly.

Scoped to the apps/mail frontend; ~1300 additions / ~560 deletions across 22 files. Notable items:

• Include Internal toggle (PR #959): new SystemTenantCheckbox + useSystemTenantIds hook (fetches GET /v1/tenants?tenant_type=System); selected IDs merged into the X-Workspace-Tenant-IDs header. Persisted includeSystemTenants flag added to the workspace Zustand store, gated behind a new VIEW_SYSTEM_TENANT_SELECTOR permission. Label resolved dynamically from tenant-types API.
• Refactor: app-header.tsx shrunk from ~535 to ~168 lines by extracting useWorkspaceOptions and useWorkspaceSelectorState hooks (300–400 line limit), with dead ModeToggle code removed.
• Folder actions: Activate/Deactivate now driven by folder status; bulk activate added. Fixed is_system_folder → is_system type mismatch so the disabled guard fires; system folders filtered out of bulk payloads; disabledTooltip support added to ActionItem.
• Upload Center (BatchForm): switched from AsyncPaginate to AsyncSelect with search, result counter, Load More + IntersectionObserver auto-paging; tenant_ids now sent as URL query params to filter by a single selected enterprise.
• Enterprise dropdown: added cacheUniqs / client-dependent key and reordered effects so the AsyncPaginate cache reloads when the client changes.
• Bug fixes: ref-based guard (hasAttemptedInitialLoadRef) stops an infinite fetch loop in MultipleSelector on empty results; removed phantom permanent field from the folder-delete payload (backend expects force_delete); responsive tab layout applied to mail, batch-mail, and batch-document detail pages.

Moderate. The changes touch shared workspace scoping (the X-Workspace-Tenant-IDs header) and the global app header, so a regression could affect what data any user sees, not just system users. Mitigations: the Internal toggle is permission-gated and defaults off, persisted state is re-checked against current permissions, and the dropdown/loop fixes are defensive. The large header refactor is functionally equivalent code movement. Risk is contained to the Mail app and this is a QA promotion, not Production.

• As a system user, toggle "Include Internal" on/off and confirm grids/results include then exclude internal-tenant data; reload to confirm the choice persists; confirm a non-permitted user never sees the checkbox.
• Change the Workspace Owner and verify the Enterprise dropdown reloads with the correct options (no stale list).
• In the Upload Center picker, test search, the "Showing X of Y" counter, scroll-to-load-more, and filtering when exactly one enterprise is selected.
• Verify folder rows show Activate vs Deactivate per status, bulk activate works, and system folders cannot be deactivated (tooltip + warning toast).
• Open a search that returns zero results and confirm there is no repeating/looping network call.
• Confirm folder delete still works (force delete) and that detail-page tabs scroll horizontally without wrapping on a narrow viewport.