Canned responses: analyst page + developer guide (#909)
Canned-Responses.md — using the Templates button, the merge-code table,
saving/editing your own from the reply box, what shared templates are for,
multi-company scoping, and an honest list of what v1 does not do.
Canned-Responses-Developer-Guide.md — the colour-keyed file table first, then
the parts that are easy to get wrong:
- two nullable columns in one row meaning two DIFFERENT things (analyst_id =
shared-with-team, tenant_id = the config-list meaning, not the scoped-data
one)
- why the permission had to split by SCOPE rather than by table, and the
check-the-scope-being-SAVED rule that stops an analyst promoting their own
draft into the team list
- reuse the email templates' merge-code vocabulary, but NOT their raw
resolveMergeCodes() — the values come from a stranger's From header
- why the body is deliberately not sanitised
- how it was actually verified (upgrade path, refusals paired with positive
controls, a real XSS payload, headless-Chrome parse-check with a negative
control, D005)
Every file and function named in the tables was checked to exist on disk, and
every internal link to resolve. Linked from the sidebar under Tickets and from
Tickets.md (feature section + the settings-tabs list).