feat: govern file lifecycle and connector writes

webui/src/features/files/FilesPage.tsx

@@ -167,6 +167,7 @@ export default function FilesPage({ settings, auth }: {settings: ApiSettings;aut
   const [connectorLoading, setConnectorLoading] = useState(false);
   const [connectorError, setConnectorError] = useState("");
   const [connectorSpaceLabel, setConnectorSpaceLabel] = useState("");
+  const [connectorSpaceReadOnly, setConnectorSpaceReadOnly] = useState(true);
   const [connectorSpaceOwnerSpaceId, setConnectorSpaceOwnerSpaceId] = useState("");
   const [connectorSpaceItemsBySpace, setConnectorSpaceItemsBySpace] = useState<Record<string, FileConnectorBrowseItem[]>>({});
   const [connectorSpaceLibraryBySpace, setConnectorSpaceLibraryBySpace] = useState<Record<string, string | null>>({});
@@ -584,6 +585,7 @@ export default function FilesPage({ settings, auth }: {settings: ApiSettings;aut
     setConnectorError("");
     setConnectorSelectedItem(null);
     setConnectorSpaceLabel("");
+    setConnectorSpaceReadOnly(true);
     resetArchiveUploadState();
   }
 
@@ -1103,6 +1105,7 @@ export default function FilesPage({ settings, auth }: {settings: ApiSettings;aut
         library_id: connectorLibraryId || undefined,
         remote_path: remotePath,
         sync_mode: "manual",
+        read_only: connectorSpaceReadOnly,
         metadata: {
           created_from_ui: true,
           source_label: activeConnectorProfile?.label,
@@ -2903,6 +2906,19 @@ export default function FilesPage({ settings, auth }: {settings: ApiSettings;aut
             <FormField label="i18n:govoplan-files.space_label.ec892726">
               <input value={connectorSpaceLabel} onChange={(event) => setConnectorSpaceLabel(event.target.value)} disabled={busy} placeholder={connectorSpaceSuggestedLabel()} />
             </FormField>
+            <FormField label="Connector mode" help="Two-way mode permits explicit writes only. Remote deletion, rename, and move propagation remain disabled.">
+              <select
+                value={connectorSpaceReadOnly ? "read-only" : "two-way"}
+                onChange={(event) => setConnectorSpaceReadOnly(event.target.value !== "two-way")}
+                disabled={busy}>
+                <option value="read-only">Read-only</option>
+                <option
+                  value="two-way"
+                  disabled={activeConnectorProfile?.provider !== "s3" || !activeConnectorProfile.capabilities.includes("write")}>
+                  Two-way (S3, explicit writes)
+                </option>
+              </select>
+            </FormField>
           </div>
 
           <div className="connector-browser">