feat: consolidate shared UI and harden browser authority for release

webui/conformance/CredentialReferencesScenario.tsx

@@ -0,0 +1,18 @@
+// Exercise the real shared credential editor with Mail's optional capability.
+// API fixtures supply public metadata only; this never loads or saves secrets.
+import CredentialEnvelopeManager from "../src/components/CredentialEnvelopeManager";
+import { PlatformModulesProvider } from "../src/platform/ModuleContext";
+import { mailCredentialReferenceSelectors } from "../../../govoplan-mail/webui/src/features/mail/mailReferenceProviders";
+import type { ApiSettings, PlatformWebModule } from "../src/types";
+
+const settings: ApiSettings = { apiBaseUrl: "", apiKey: "", accessToken: "" };
+const modules: PlatformWebModule[] = [{
+  id: "mail", label: "Mail", version: "1",
+  uiCapabilities: { "core.credentialReferenceSelectors": mailCredentialReferenceSelectors }
+}];
+
+export default function CredentialReferencesScenario() {
+  return <PlatformModulesProvider modules={modules}>
+    <CredentialEnvelopeManager settings={settings} scopeType="tenant" canWrite />
+  </PlatformModulesProvider>;
+}