feat: centralize access explanation subject selection

webui/tests/resource-access-explanation.test.tsx

@@ -47,6 +47,42 @@ assert(explanationMarkup.includes("i18n:govoplan-core.no_source.6dcf9723"), "mis
 assert(!explanationMarkup.includes("govoplan-campaign"), "the shared component does not depend on Campaign wording");
 assert(!explanationMarkup.includes("govoplan-files"), "the shared component does not depend on Files wording");
 
+const selectableSubjectMarkup = renderToStaticMarkup(
+  <ResourceAccessExplanation
+    explanation={null}
+    subjects={{
+      mode: "cross_user",
+      can_select_other_users: true,
+      reason: "Policy permits an administrator diagnostic.",
+      source: "policy.permission",
+      required_scope: "policy:access_explanation:select_user",
+      users: [
+        { id: "user-1", display_name: "Current Reader" },
+        { id: "user-2", email: "other@example.test" }
+      ]
+    }}
+    selectedUserId="user-2"
+    onSelectedUserIdChange={() => undefined}
+  />
+);
+assert(selectableSubjectMarkup.includes("<select"), "the shared component owns the subject picker");
+assert(selectableSubjectMarkup.includes("other@example.test"), "permitted subject metadata is rendered");
+assert(selectableSubjectMarkup.includes("Policy permits"), "the policy reason remains visible");
+
+const currentUserSubjectMarkup = renderToStaticMarkup(
+  <ResourceAccessExplanation
+    subjects={{
+      mode: "current_user",
+      can_select_other_users: false,
+      reason: "Policy limits explanations to the signed-in user.",
+      source: "policy.permission",
+      users: [{ id: "user-1", display_name: "Current Reader" }]
+    }}
+  />
+);
+assert(!currentUserSubjectMarkup.includes("<select"), "current-user mode does not expose a directory picker");
+assert(currentUserSubjectMarkup.includes("signed-in user"), "current-user policy is explained");
+
 const emptyMarkup = renderToStaticMarkup(
   <ResourceAccessExplanation
     fallbackResourceLabel="Fallback resource"