feat(chart-types): allow linking external connections

[almeidabbm]

Closes: #28056
Closes: PROD-10583

Description:

Custom chart types render in the same sandboxed iframe as data apps, so images from URL fields are blocked by CSP unless the chart type is linked to an external connection with "Allow public images in linked apps". The chart type builder had no way to attach those connections.

This PR adds connection attachment to the custom chart type generate/iterate flow, matching data apps. The backend already accepted externalConnections on generate/iterate and already injected linked origins into the preview-token CSP.

• First build and iterate. The composer can attach connections onto the generate/iterate request (uuid + alias only). Selected connections can be removed before submission.
• Settings copy. Project Settings → Data app connections, the public-images toggle, and the builder-linking label now mention chart types as well as data apps.

chart-type-build-only-connection-attach.mp4

Risk assessment:

• This is a high-risk change

[linear-code]

PROD-10583

[github-actions]

🛡️ Upgrade safety for self-hosted customers

Comparing against main (4ddd02c84a).

• ✅ Safe to upgrade normally. No downtime needed.
• No database changes in this release.

What we looked at

What	Result
Database changes	none
REST API	no breaking changes
MCP tools	no breaking changes
Config / environment	no breaking changes
Declared breaking changes	none
Upgrade notes	none

Technical details (raw JSON)

{
  "schemaVersion": "2",
  "version": "pr-28136",
  "previousVersion": "4ddd02c84a",
  "releaseDate": "2026-08-27T16:30:20.152Z",
  "migrations": {
    "present": false,
    "count": 0,
    "coreCount": 0,
    "eeCount": 0,
    "files": []
  },
  "compatibility": {
    "rollingUpdateSafe": true,
    "recommendedStrategy": "RollingUpdate"
  },
  "api": {
    "rest": {
      "checked": true,
      "breaking": false,
      "changes": [],
      "breakingCount": 0,
      "advisories": [],
      "advisoryCount": 0
    },
    "mcp": {
      "checked": true,
      "breaking": false,
      "changes": [],
      "breakingCount": 0,
      "advisories": [],
      "advisoryCount": 0
    }
  },
  "config": {
    "checked": true,
    "breaking": false,
    "changes": []
  },
  "upgrade": {
    "minPreviousVersion": null,
    "requiredStops": []
  },
  "declaredBreaks": []
}

---

_{Automated upgrade-safety check. Once merged, it ships a small release-safety.json with the release so customers’ upgrade automation can read it. It covers database, API, and config/environment changes.}

[github-actions]

🧪 Test Selection

✅ Tests that will run

Test	Description
Preview Environment	Deploys a preview environment for testing
Frontend E2E Tests	Runs Cypress app tests
Backend API Tests	Runs Vitest API tests
CLI Tests	Runs CLI integration and dbt version tests

⏭️ Tests skipped (no relevant file changes detected)

Test	How to trigger manually
Timezone Tests	Add test-timezone to PR description

Tip: Add test-all to your PR description to run all tests.

[github-actions]

Your preview environment pr-28136 has been deployed.

Preview environment endpoints are available at:

• https://lightdash-pr-28136.lightdash.okteto.dev
• https://lightdash-preview-pr-28136.lightdash.okteto.dev

[github-actions]

Preview Environment

🌐 URL: https://lightdash-preview-pr-28136.lightdash.okteto.dev

📋 Logs: View in GCP Console

🔧 SSH: ./scripts/okteto-ssh.sh 28136

[lightdash-bot]

🎉 This PR is included in version 2.37.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀