feat(directory): Phase 3 — Reviews / MDM / Tags / Teams / DP+DC team-member

[larsgeorge-db]

Phase 3 of the directory-lookup-and-principal-picker plan (#375). Stacked on #412 — base is feat/directory-phase2 so the diff here is Phase-3 only. Rebases onto main once the rest of the stack lands.

Plan: #375
Backend: #406
Phase 1 frontend: #407
Phase 2: #412

Summary

Five mechanical migrations onto PrincipalPicker. No new backend routes; every existing endpoint accepts the same payload shape it already did.

Surface	Field	Picker config	Backend payload
Data Asset Reviews — Create	reviewer_email	single, user	unchanged
MDM — Create Review	reviewer_email	single, user (RHF Controller)	unchanged
Tag-namespace ACL	permissionForm.group_id	single, group	unchanged
Teams form	member_identifier	single, dynamic — accepts flips between ['user'] and ['group'] on the row's member_type toggle	unchanged
Data-product team-member	username	single, user	unchanged (username)
Data-contract team-member	email/username	single, user	unchanged (still populates both username and email for ODCS backward compat)

Helpers added

• lib/team-members.ts:
  • principalAcceptsForMemberType(memberType) — Teams type-switching.
  • buildContractTeamMember({emailOrUsername, role, name}) — DC dual-population helper (trims, omits name when blank, populates both username and email with the same picked id).

Test plan

• Type-check clean (yarn type-check).
• Full frontend suite: 705 passed, 6 skipped, 0 failed.
• New tests (6, lib/team-members.test.ts):
  • principalAcceptsForMemberType: 'user' → ['user'], 'group' → ['group'], defaults to ['user'] for null / undefined / '' / unrecognised values.
  • buildContractTeamMember: populates both username and email with the picked id; trims surrounding whitespace on every field; omits name entirely when blank or undefined.
• Per-page form-dialog mounts continue to be deferred to Playwright E2E (Radix dialogs hang in jsdom — same convention as the existing skipped role-form-dialog.test, team-form-dialog.test, project-form-dialog.test, tag-selector.test).
• Manual smoke test of each surface in both configured + unconfigured modes (left for reviewer / follow-up).

Acceptance criteria from the plan (Phase 3)

• All five surfaces accept picker output and round-trip through their existing endpoints with no payload-shape change.
• In Teams, switching member_type from user to group resets the picker's accepts filter without losing form state for the other row fields (per-row picker remounts; sibling rows and the row's role / domain / project fields stay intact).
• Tooltips on selected badges across all surfaces expose the underlying identifier (carried over from the Phase 1 picker).
• Pre-existing reviewer assignments, MDM reviews, tag permissions, team rosters, and product/contract team members continue to render and save identically when the directory is not configured (picker auto-degrades to plain manual entry).
• Frontend tests cover at least Reviews + MDM (single-user) and Teams (type-switching) flows — via the extracted helpers; full-mount Radix tests deferred to E2E per repo convention.

What's intentionally not here

• Workflow Designer "Custom principals" toggle (notification + approval recipients/approvers).
• Data-contract wizard owner/stakeholders/groups/primary-support-email wiring.

Both land in Phase 4.