feat(settings): Gegevens van de portal as settings-form and chips-field config

[rubenvdlinde]

"Gegevens van de portal" on the portal's Instellingen tab is manifest config: one settings-form card (nextcloud-vue 2.83) with every field the old PortalDetailsForm had, saved with one Save. PortalDetailsForm.vue, src/lib/portalDetails.js and the registry entry are deleted. Bumps @conduction/nextcloud-vue to ^2.83.0.

Old form -> this form

• Name required, slug pattern, origin pattern: required / pattern on the fields; nothing is sent while a field is wrong.
• Languages and "May be embedded on": chips fields inside the form (one form, REQ-PDE-004, the board's single card), saved with Save. Languages: at least one ("Choose at least one language."), default ["nl"], free codes as the old taggable select allowed, lowercased.
• Defaults for an absent kind (site) and header (double), the values the site already assumes.
• Patch only what changed, baseline moves after a save: built into settings-form.
• Logo: a reference field over this portal's published Media images (filter: {kind: image, status: published, portal: "@object.slug"}), stored as /apps/portaliq/api/content/media/{id}?portal={portal}, PLUS a typed address (free: true, "Of een webadres"). The typed value answers to ^(/(?!/)\S*|https?://\S+)$: root-relative or http(s), what PortalRuntimeConfigResolver::logoUrl() lets through.

Named differences

• An empty name says the library's "Vul dit in." instead of "Geef de portal een naam.".
• The first Save also writes the shown defaults (kind, header, languages) when the portal had none.
• A typed logo with an upper-case scheme (HTTPS://) is refused; logoUrl() would accept it.

Verified live (admin, open-venray, Instellingen tab, :8080, head 53c24f7)

• Labels in order, Dutch; header shows double for a portal without one; the languages hint shows once (2.83 #1588).
• Logo list: "Geen logo" + only open-venray's image (an open-tilburg test image was not listed).
• Removing the last language refused; Nederlands refused; DE stored as de; www.example.nl refused.
• One Save: ONE PATCH {headerVariant, locales, logo: "/apps/portaliq/api/content/media/<id>?portal=open-venray", frameAncestors}, notice "De portal is opgeslagen.", API shows all four.
• Typed logo javascript:alert(1) refused with "Een logo-adres begint met /, http:// of https://."; /apps/portaliq/logo/open-venray.svg saved and stays selected.
• Empty name refused. Portal restored, test media items deleted.

Gates (exit codes, head 53c24f7)

• npm run build 0.
• node --test tests/*.spec.mjs 1: 1547 tests, 1546 pass, 1 inherited (example-site "the Zuiddrecht site holds what the design shows": 39 pages vs 38, from development's site JSON; this branch does not touch it).
• PHPUnit --no-coverage 2: 3878 tests, 6 errors, all inherited HostRootRedirectBootTest.
• manifest-v2, registry, validate-manifest 0; eslint on the changed spec 0; check:l10n-js 0.

Pixel PtPortalInstellingen (pieter)

9.67% before (development) -> 9.69% after (the logo card has one more input).

🤖 Generated with Claude Code

[github-actions]

Quality Report — ConductionNL/portaliq @ e3c20cb

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-specs		✅
check-manifest		✅
format		✅
check-l10n-js		✅
check-schema-l10n		✅
check-reuse		✅
composer			✅	✅ 108/108
npm			✅	✅ 984/984
app:check-code	⏭️
info.xml	✅
REUSE	✅
lockfile sync		✅
PHPUnit					✅ 3809/3809 · 1 skipped
Newman					✅ 1/1
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it locally with npx playwright test, or from the Actions tab on a branch with no open pull request into development.
Hydra gates					❌

---

Quality workflow — 2026-10-12 17:00 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/portaliq @ 50b0823

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-specs		✅
check-manifest		✅
format		✅
check-l10n-js		✅
check-schema-l10n		✅
check-reuse		✅
composer			✅	✅ 108/108
npm			✅	✅ 984/984
app:check-code	⏭️
info.xml	✅
REUSE	✅
lockfile sync		✅
PHPUnit					🚨 NO VERDICT — enabled but never ran
Newman					🚨 NO VERDICT — enabled but never ran
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it locally with npx playwright test, or from the Actions tab on a branch with no open pull request into development.
Hydra gates					⏭️

---

Quality workflow — 2026-10-14 09:14 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/portaliq @ 0470e94

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-specs		❌
check-manifest		✅
format		✅
check-l10n-js		✅
check-schema-l10n		✅
check-reuse		✅
composer			✅	✅ 108/108
npm			✅	✅ 984/984
app:check-code	⏭️
info.xml	✅
REUSE	✅
lockfile sync		✅
PHPUnit					✅ 3877/3877 · 1 skipped
Newman					✅ 1/1
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it locally with npx playwright test, or from the Actions tab on a branch with no open pull request into development.
Hydra gates					❌

---

Quality workflow — 2026-10-14 13:46 UTC

Download the full PDF report from the workflow artifacts.