Portal policies: SUI setup forms fixes and improvements (Stirling-Tools#6927)

## What this does

Reworks the portal's policy setup screens so a policy reads as **its own
settings**
rather than a list of tools you wire together, and rebuilds the forms on
the
shared design system so they match the rest of the portal.

## Why

Setup showed one card per underlying tool (tool name + a toggle), which
exposed
the "a policy is a pipeline of tools" plumbing. A policy should read in
terms of
what it does to a document, not which tools run under the hood.

## Changes

- **Setup reads as policy settings.** The per-tool cards are now a
plain-language
list of what the policy does — "Redact sensitive information", "Strip
active
content", "Apply a watermark", and so on — each with a short description
and a
  toggle, with its options appearing inline when turned on.
- **Consistent design system.** The setup and edit forms use the shared
  components instead of one-off styling.
- **Simpler setup.** Removed two sections that aren't part of what ships
here:
  Document Types (scope-by-type) and Retries.
- **Watermarks are text-only.** A policy watermark is a text stamp, so
the image
  option and the type picker are hidden.
- **The editor always shows as a source** (it used to disappear when no
other
  sources were connected), and the source tiles now lay out correctly.
- **Clearer upsell copy.** Locked policies read **"Upgrade to
Enterprise"**
  instead of "Coming soon".

## Scope

UI only — no backend changes. Keeping a policy's settings in sync
between the
portal and the editor is a known, separate issue and is **not** part of
this PR.

## Testing

Prettier, ESLint, typecheck (proprietary + saas), and the
unused-translation
guard all pass. Setup screens verified in Storybook.

Author: reecebrowne

frontend/editor/public/locales/en-US/translation.toml

@@ -7404,7 +7404,7 @@ subtitle = "Standing automations that enforce a tool pipeline on every document.
 title = "Policies"
 
 [portal.policies.card]
-comingSoon = "Coming soon"
+comingSoon = "Upgrade to Enterprise"
 notSetUp = "Not set up"
 
 [portal.policies.categories.compliance]
@@ -7566,14 +7566,29 @@ continue = "Continue"
 enablePolicy = "Enable policy"
 saveChanges = "Save changes"
 
-[portal.policies.wizard.docTypes]
-allDescription = "Set up an Ingestion (classification) policy to narrow this to specific document types."
-allTitle = "All document types"
-clear = "Clear"
-heading = "Document types"
-narrow = "Narrow"
-selected_one = "{{count}} selected"
-selected_other = "{{count}} selected"
+[portal.policies.wizard.capability.compress]
+desc = "Compresses the document to a smaller file size."
+label = "Reduce file size"
+
+[portal.policies.wizard.capability.flatten]
+desc = "Merges form fields and annotations into the page so they can't be edited."
+label = "Flatten the document"
+
+[portal.policies.wizard.capability.ocr]
+desc = "Runs OCR so scanned pages become selectable, searchable text."
+label = "Make text searchable"
+
+[portal.policies.wizard.capability.redact]
+desc = "Finds and blacks out sensitive details — like Social Security and card numbers — so they can't be read."
+label = "Redact sensitive information"
+
+[portal.policies.wizard.capability.sanitize]
+desc = "Removes hidden JavaScript so nothing can run automatically when the document is opened."
+label = "Strip active content"
+
+[portal.policies.wizard.capability.watermark]
+desc = "Stamps a visible mark (e.g. “Confidential”) across every page."
+label = "Apply a watermark"
 
 [portal.policies.wizard.errors]
 noTools = "Enable at least one tool in the workflow first."
@@ -7594,11 +7609,6 @@ label = "Output as"
 newFile = "New file"
 newVersion = "New version"
 
-[portal.policies.wizard.output.retries]
-delayLabel = "Retry delay (min)"
-heading = "Retries"
-maxLabel = "Max retries"
-
 [portal.policies.wizard.output.runOn]
 export = "Export"
 helper = "When the policy fires: on upload, or before export."
@@ -7609,22 +7619,20 @@ upload = "Upload"
 heading = "Settings"
 
 [portal.policies.wizard.sources]
-emptyDescription = "Connect a source on the Sources page first, then attach it to a policy here."
-emptyTitle = "No sources available"
 heading = "Sources"
 loading = "Loading sources…"
 
 [portal.policies.wizard.tabs]
 ariaLabel = "Setup steps"
 settings = "Settings"
-workflow = "Workflow"
+workflow = "Actions"
 
 [portal.policies.wizard.title]
 edit = "Edit {{category}} policy"
 setUp = "Set up {{category}} policy"
 
 [portal.policies.wizard.workflow]
-description = "The sequence of tools this policy runs on each document. Each tool is a Stirling endpoint; toggle the ones this policy should enforce."
+description = "Choose what this policy does to every document it processes."
 
 [portal.policySummary]
 activeSummary = "{{active}} / {{total}} active"
@@ -7633,7 +7641,7 @@ subtitle = "Standing automations every document passes through, regardless of wh
 title = "What runs on your PDFs"
 
 [portal.policySummary.action]
-comingSoon = "Coming soon"
+comingSoon = "Upgrade to Enterprise"
 configure = "Configure"
 setUp = "Set up"
 

frontend/editor/src/core/components/tools/addWatermark/AddWatermarkSingleStepSettings.tsx

@@ -23,27 +23,33 @@ interface AddWatermarkSingleStepSettingsProps {
   disabled?: boolean;
   /** When false, hide the "Flatten PDF pages to images" option (e.g. in policies). */
   showFlatten?: boolean;
+  /** When true, lock to text watermarks: hide the type selector and image option (e.g. in policies). */
+  textOnly?: boolean;
 }
 
 const AddWatermarkSingleStepSettings = ({
   parameters,
   onParameterChange,
   disabled = false,
   showFlatten = true,
+  textOnly = false,
 }: AddWatermarkSingleStepSettingsProps) => {
+  const isText = textOnly || parameters.watermarkType === "text";
+  const isImage = !textOnly && parameters.watermarkType === "image";
   return (
     <Stack gap="lg">
-      {/* Watermark Type Selection */}
-      <WatermarkTypeSettings
-        watermarkType={parameters.watermarkType}
-        onWatermarkTypeChange={(type) =>
-          onParameterChange("watermarkType", type)
-        }
-        disabled={disabled}
-      />
+      {/* Watermark type selection — hidden when locked to text. */}
+      {!textOnly && (
+        <WatermarkTypeSettings
+          watermarkType={parameters.watermarkType}
+          onWatermarkTypeChange={(type) =>
+            onParameterChange("watermarkType", type)
+          }
+          disabled={disabled}
+        />
+      )}
 
-      {/* Conditional settings based on watermark type */}
-      {parameters.watermarkType === "text" && (
+      {isText && (
         <>
           <WatermarkWording
             parameters={parameters}
@@ -58,7 +64,7 @@ const AddWatermarkSingleStepSettings = ({
         </>
       )}
 
-      {parameters.watermarkType === "image" && (
+      {isImage && (
         <WatermarkImageFile
           parameters={parameters}
           onParameterChange={onParameterChange}
@@ -67,7 +73,7 @@ const AddWatermarkSingleStepSettings = ({
       )}
 
       {/* Formatting settings for both text and image */}
-      {parameters.watermarkType && (
+      {(textOnly || parameters.watermarkType) && (
         <WatermarkFormatting
           parameters={parameters}
           onParameterChange={onParameterChange}

frontend/editor/src/portal/PortalApp.tsx

@@ -3,6 +3,7 @@ import { PortalAuthBoundary } from "@portal/auth/PortalAuthBoundary";
 import { ThemeProvider, useTheme } from "@portal/contexts/ThemeContext";
 import { SuiProvider } from "@portal/theme/SuiProvider";
 import { PortalProviders } from "@portal/PortalProviders";
+import { ToolRegistryProvider } from "@app/contexts/ToolRegistryProvider";
 // Reset + typography, scoped to .portal-scope below.
 import "@portal/theme/base.css";
 
@@ -32,9 +33,13 @@ export function PortalApp() {
       <ThemedSuiProvider>
         {/* Scopes base.css to the portal so it doesn't restyle the host editor. */}
         <div className="portal-scope">
-          <PortalAuthBoundary>
-            <PortalProviders />
-          </PortalAuthBoundary>
+          {/* Tool registry is read by portal views (e.g. the policy setup
+              wizard); mount it above the per-flavor provider split. */}
+          <ToolRegistryProvider>
+            <PortalAuthBoundary>
+              <PortalProviders />
+            </PortalAuthBoundary>
+          </ToolRegistryProvider>
         </div>
       </ThemedSuiProvider>
     </ThemeProvider>

frontend/editor/src/portal/components/policies/PolicySetupWizard.stories.tsx

@@ -1,4 +1,5 @@
 import type { Meta, StoryObj } from "@storybook/react-vite";
+import { ToolRegistryProvider } from "@app/contexts/ToolRegistryProvider";
 import {
   POLICY_CATEGORIES,
   POLICY_CONFIG,
@@ -12,6 +13,15 @@ const meta: Meta<typeof PolicySetupWizard> = {
   title: "Portal/Policies/PolicySetupWizard",
   component: PolicySetupWizard,
   parameters: { layout: "fullscreen" },
+  // The wizard reads the tool registry (for capability fallback names/icons),
+  // so stories must supply the provider the app mounts in PortalApp.
+  decorators: [
+    (Story) => (
+      <ToolRegistryProvider>
+        <Story />
+      </ToolRegistryProvider>
+    ),
+  ],
   args: {
     onClose: () => {},
     onSubmit: async () => {},