Add governed encryption administration

tests/test_manifest.py

@@ -16,7 +16,7 @@ from govoplan_encryption.backend.local_provider import LOCAL_PROVIDER_ID
 
 
 class EncryptionManifestTests(unittest.TestCase):
-    def test_manifest_exposes_headless_governed_capabilities(self) -> None:
+    def test_manifest_exposes_governed_capabilities_and_operator_ui(self) -> None:
         manifest = get_manifest()
 
         self.assertEqual("encryption", manifest.id)
@@ -35,7 +35,21 @@ class EncryptionManifestTests(unittest.TestCase):
         )
         self.assertIsNotNone(manifest.route_factory)
         self.assertIsNotNone(manifest.migration_spec)
-        self.assertIsNone(manifest.frontend)
+        self.assertIsNotNone(manifest.frontend)
+        self.assertEqual("@govoplan/encryption-webui", manifest.frontend.package_name)
+        self.assertEqual(
+            {
+                "encryption.admin.operations",
+                "encryption.admin.vaults",
+                "encryption.admin.migrations",
+                "encryption.admin.recovery",
+            },
+            {surface.id for surface in manifest.frontend.view_surfaces},
+        )
+        self.assertIn(
+            "encryption.administration",
+            {topic.id for topic in manifest.documentation},
+        )
         self.assertEqual("vertical_slice", manifest.architecture.maturity)