Add conversational editing for orchestration plans

[Paul Lizer (paullizer)]

Summary

Base: paullizer-react-v2-ui. This change builds on the React V2 integration branch, including the approval-preference persistence fix in #1460.

• Add Edit beside Review, with a full-screen plan preview, scoped planner chat, and revision history matching the existing visual-editor experience.
• Allow users to add, remove, refine, and restore steps through server-validated plan revisions without adding duplicate messages to the main conversation.
• Hold edited plans for explicit approval; protect against stale approvals, conflicting revisions, and cancellation of newer unseen questions. Running plans remain read-only.
• Preserve account-level approval preferences, document the workflow, and advance the application version to 0.261.102.

Linked issue

N/A — requested directly; no associated issue.

Release Notes & Latest Features

• New Feature
• Bug Fix
• UI Enhancement
• Breaking Change
• Internal only

Is this visible to end users?

• Yes
• No

Is this admin-facing (Admin Settings, governance, deployment, config)?

• Yes
• No

Should this become a Latest Feature card?

• Yes
• No
• Already added

Screenshot needed for the card?

• Yes
• No
• Attached

Version bump

• application/single_app/config.py VERSION third segment bumped, or not needed because this is docs-only
• deployers/version.txt bumped, or not needed because deployers/ was not changed

Application: 0.261.101 → 0.261.102. No deployer changes.

Testing / validation

• From functional_tests: python -m unittest -q test_orchestration_plan_revision_routes test_orchestration_conversation_context_routes test_orchestration_plan_revision_store test_orchestration_plan_revision_planner — 99 passed.
• python -m pytest functional_tests/test_v2_orchestration_approval_persistence.py -q — 17 passed.
• python -m pytest ui_tests/test_v2_orchestration_plan_editor_backend.py ui_tests/test_v2_orchestration_plan_editor.py ui_tests/test_v2_orchestration_approval_persistence.py -q — 55 passed, including browser-to-Flask editing, clarification, restore, cancellation, and execution workflows.
• npm --prefix application/v2_ui run build — passed TypeScript compilation and the production build; the existing large-chunk advisory remains.
• Python compilation, Swagger route validation, changed-line XSS/access-control guardrails, all three route-policy scripts, documentation coverage, and documentation site-quality checks passed.

Model, search, and Cosmos service boundaries are deterministic in automated coverage; no live Azure resources were provisioned.

Documentation

• Release notes updated, or not needed
• Feature documentation updated, or not needed
• Fix documentation updated, or not needed

Added docs/explanation/features/V2_ORCHESTRATION_PLAN_EDITING.md and docs/guides/review-and-edit-orchestration-plans.md; updated orchestration and chat-control references. Release notes were left unchanged pending publication approval. The generated application-surface inventory remains current.

Security checklist

• New Flask routes include @swagger_route(security=get_auth_security())
• Settings sent to non-admin frontends use sanitize_settings_for_user()
• Browser JavaScript is served from local SimpleChat static assets only; no CDN-hosted JS
• No secrets, keys, connection strings, or local-only artifacts are included

New editor responses use an allowlisted projection rather than returning raw settings or private run context. Ownership, capability/source permissions, revision tokens, and conditional Cosmos writes protect edit and execution operations.