feat: govern file lifecycle and connector writes

webui/src/features/files/FileConnectorSettingsPanel.tsx

@@ -76,6 +76,7 @@ type ConnectorProfileDraft = {
   canBrowse: boolean;
   canImport: boolean;
   canSync: boolean;
+  canWriteRemote: boolean;
   policyMode: PolicyMode;
   allowedPaths: string;
   deniedPaths: string;
@@ -509,7 +510,8 @@ export default function FileConnectorSettingsPanel({
     const capabilities = [
     draft.canBrowse ? "browse" : "",
     draft.canImport ? "import" : "",
-    draft.canSync ? "sync" : ""].
+    draft.canSync ? "sync" : "",
+    draft.canWriteRemote ? "write" : ""].
     filter(Boolean);
     const sharedPayload = {
       label,
@@ -1365,6 +1367,7 @@ export default function FileConnectorSettingsPanel({
                 <ToggleSwitch label="i18n:govoplan-files.browse.2f3b5c55" checked={draft.canBrowse} disabled={saving} onChange={(canBrowse) => patchDraft({ canBrowse })} />
                 <ToggleSwitch label="i18n:govoplan-files.import.d6fbc9d2" checked={draft.canImport} disabled={saving} onChange={(canImport) => patchDraft({ canImport })} />
                 <ToggleSwitch label="i18n:govoplan-files.sync.905f6309" checked={draft.canSync} disabled={saving} onChange={(canSync) => patchDraft({ canSync })} />
+                <ToggleSwitch label="Remote write" checked={draft.canWriteRemote} disabled={saving || draft.provider !== "s3"} onChange={(canWriteRemote) => patchDraft({ canWriteRemote })} />
               </div>
               <FormGrid columns={2} collapseAt="standard" className="">
                 <FormField label="i18n:govoplan-files.policy.bb9cf141" documentation={CONNECTOR_DOCUMENTATION}>
@@ -1528,6 +1531,7 @@ function emptyDraft(scopeType: ConnectorScope): ConnectorProfileDraft {
     canBrowse: true,
     canImport: true,
     canSync: true,
+    canWriteRemote: false,
     policyMode: "allow-provider",
     allowedPaths: "",
     deniedPaths: "",
@@ -1566,6 +1570,7 @@ function draftFromProfile(profile: FileConnectorProfile, scopeType: ConnectorSco
     canBrowse: profile.capabilities.includes("browse"),
     canImport: profile.capabilities.includes("import"),
     canSync: profile.capabilities.includes("sync"),
+    canWriteRemote: profile.capabilities.includes("write"),
     policyMode: denyProviders.includes("*") || denyProviders.includes(profile.provider) ? "deny-provider" : allowPaths.length > 0 ? "allowed-paths" : "allow-provider",
     allowedPaths: allowPaths.join("\n"),
     deniedPaths: denyPaths.join("\n"),