feat(cyod): iOS signing certificates for org and project

fix(cyod): hide activate for expired certs, surface field errors

The activate button no longer renders for an expired certificate. mycroft
now answers 400 for that (cannot activate an expired certificate), so
offering the button only produced a guaranteed error.

Removed rather than disabled, on two counts: the row already carries an
Expired chip in error colour, so the absence is explained on screen; and the
template already removes rather than disables for the analogous case -- an
already-active cert has no button either. One condition, same shape as the
one beside it.

parse-error: read DRF field-keyed error bodies. Validation failures on the
signing-certificate upload now come back as {'p12': ['file too large...']}
rather than {'detail': ...}, because the validation moved into the
serializer. Without this the user saw the generic 'please try again' and
lost the reason.

The new branch is appended last in the existing if/else chain, so detail,
message, title and the 500/0 statuses all short-circuit before it -- none of
the ~160 existing call sites change behaviour. It only reads values that are
arrays of strings, which is the shape DRF produces for field errors, so a
stray string field in an error body is not mistaken for the message.

There was no test for parse-error at all; there are 7 now, covering the new
shape and pinning the existing ones. 16 component tests pass, including the
new expired-cert case.

fix(cyod): review fixes for the iOS signing certificates

- Limit the project-scope panel to org admins and owners. The org-scope panel
  is owner-only, so without this the project-scope override let any member
  upload a .p12 and password, read enrolled UDIDs, and delete the certificate.
- Allow deleting a lone active certificate. Exactly one certificate is always
  active, so gating on is_active alone locked a single-certificate org out of
  ever removing it; the backend only refuses while siblings exist.
- Fix the provisioning-profile picker, which rendered a button rather than a
  label and so never opened its hidden file input.
- Mark the p12 password mandatory, with a primary-colour asterisk, the required
  attribute, and Save gated on it.
- Move the field labels out of AkTextField's @Label so they match the drawer's
  other labels, keeping the accessible name via aria-label.
- Put the "no certificates" empty state in a bordered box.
- Send the delete reason as a real request body and rework the tests onto
  mirage, replacing the ajax service stubs.
- Format parse-error-test.js, which was failing the lint job.

Author: Shubham Singh

app/components/organization/settings/index.hbs

@@ -22,6 +22,20 @@
 
   <AkDivider class='my-3' @color='dark' />
 
+  {{#if (and this.me.org.is_owner this.organization.isCyodEnabled)}}
+    <Organization::DeviceRegistration />
+
+    <AkDivider class='my-3' @color='dark' />
+
+    {{! Certificates are part of the CYOD setup, so they collapse with it.
+    Guarded here as well as in the component so the divider goes too. }}
+    {{#if this.organization.isCyodRegistrationEnabled}}
+      <Organization::SigningCertificate />
+
+      <AkDivider class='my-3' @color='dark' />
+    {{/if}}
+  {{/if}}
+
   <OrganizationArchive />
 
   <AkDivider class='my-3' @color='dark' />

app/components/organization/settings/index.ts

@@ -1,6 +1,7 @@
 import Component from '@glimmer/component';
 import { service } from '@ember/service';
 import type MeService from 'irene/services/me';
+import type OrganizationService from 'irene/services/organization';
 import type { OrganizationSettingsRouteModel } from 'irene/routes/authenticated/dashboard/organization-settings/index';
 
 export interface OrganizationSettingsSignature {
@@ -11,6 +12,7 @@ export interface OrganizationSettingsSignature {
 
 export default class OrganizationSettingsComponent extends Component<OrganizationSettingsSignature> {
   @service declare me: MeService;
+  @service declare organization: OrganizationService;
 }
 
 declare module '@glint/environment-ember-loose/registry' {