feat(protected_environments): remove deploy groups

[sjungwon03]

Summary

Project protected environments can now remove one existing group-based deploy grant. The dialog identifies the grant and membership, shows existing deploy/approval access, warns about deployment loss and last-grant impact, and requires exact-name confirmation and acknowledgement reset by edits.

Complete inventory/detail preflight rejects stale, missing, ambiguous and invalid targets. One PUT sends only the selected grant ID and _destroy: true. The response and authoritative read-back must equal the prior model with just that grant removed, preserving the protected environment, every other deploy grant and all approval rules/counts. Uncertain writes require fresh inspection/confirmation; an already-removed grant cannot be submitted again. Pending inputs/dismissal and account replacement are isolated.

Closes #662

Validation

• dart format --output=none --set-exit-if-changed .
• flutter analyze reports no issues
• Full app/package suites: 8,653 tests passed (app 4,922; API 3,387; design system 135; models 204; secure storage 5)
• Related controller/widget regressions: 234 tests passed; dedicated API suite: 25 tests passed
• API, controller and widget tests were run red before implementation, then green
• Both membership modes and final deploy-grant removal preserve environment protection and approval rules
• Localization regenerated for English, Korean, Japanese, Hindi and Chinese
• No model changes; build_runner is not applicable
• CI English-language policy and whitespace checks
• Synthetic mobile/desktop captures inspected in both themes
• Manually validated against a live GitLab instance (not performed; fixture-only validation)

Checklist

• Targets dev and links one issue with Closes #
• Conventional Commits and DCO sign-off
• Test-first implementation and updated behavior documentation
• Five locales at 320/800/1200 widths in both themes
• No new dependencies or third-party assets added
• No credentials, real instance hostnames or confidential data in fixtures or screenshots
• Repository text is English except supported locale translations

Screenshots

Fixture-only captures show the confirmation portion of the scrollable dialog.

Viewport	Light	Dark
Mobile, 390 × 844
Desktop, 1200 × 900

Notes for reviewers

The documented deploy-record removal uses PUT with the existing record ID and _destroy: true. This slice does not call environment unprotection. The write disables redirects and OAuth replay and checks HTTP status before strict full-rule parsing. Empty deploy access is accepted when the last grant is removed; partial or absent protection rules cannot confirm success.

Selectable records require positive stable group/grant IDs, no user selector and explicit direct/inherited membership. Reported role metadata is allowed on group grants. Unknown membership and group-level rules remain read-only; no role-only/user grant, group membership or project-sharing mutation is added.

Premium/Ultimate, enabled CI/CD and management permission are server requirements. The endpoint has no atomic compare-and-set, so another actor can change protection between preflight and read-back. Preservation covers modelled fields, and no live role/tier/self-hosted version matrix was validated. See implementation and evidence.

[sjungwon03-ai]

Review summary

Verdict: Approved

• Reviewed: protected-environment deploy-group removal API, controller, dialog safeguards, and tests
• Checks: all reported GitHub checks passed