[gibson9583]

Data Pruner publishes bare Start/Stop task names that collide with channel-control permissions. The web client also needs to load RBAC for users without an assigned role and recover the Roles panel after a temporary permission API failure.

• Map Data Pruner Refresh, Save, Start, and Stop explicitly under settings_Data Pruner in Swing, JavaScript, and the parity catalog. Channel-control grants remain independent.
• Allow authenticated users to discover and download web plugins through the exact native and Web Support discovery/resource operations. Validation, serialization, settings, role administration, and pruning operations retain their permission checks.
• Mark RBAC as an authorization provider. Retry failed permission snapshots with one in-flight request and at most three automatic retries (preserving engine idle expiry), publish only after both prerequisite APIs succeed, register Roles once on recovery, and discard results after logout/account changes.
• Exercise the real web bundle against Web Client v1.1.0, the next release containing the companion fixes.

Requires companion Web Client PR gibson9583/oie-web-client#112 for permission-tagged controls/navigation, failure-closed plugin bootstrap, and reactive Settings/palette recovery. Browser CI targets the v1.1.0 release tag. Deploy both components together for the complete correction.

Validation: 201 Java tests, 66 web unit tests, and 28 real-bundle browser tests passed without browser retries. The package build passed, and the archived web bundle matches the tested bundle. These local checks used the companion Web Client changes. CI checkout of v1.1.0 requires that release tag to be published. Browser engine responses are mocked; no live engine or database was modified.

Refs gibson9583/oie-web-support-plugin#11

[pacmano1]

Tested against two real 4.6.0 engines (rbac 1.1.3 as the control, this branch on the other), Web Support 1.0.5, and oie-web-client #112 at be9c771.

The Data Pruner fix works. A role with channel Start/Stop and the pruner's View Settings saw Prune Now and Stop Pruner on 1.1.3 and doesn't here. A role with only the pruner grants is the reverse. Logging out and back in as someone else in the same tab picks up the new permissions, and two failed my-permissions calls recover without a reload. Your suite passes 28/28 against be9c771.

Two things:

1. The exception for users with no role doesn't do anything on a real engine. When a no-role user signs in, the web admin's first call is "who am I?" (GET /api/users/current). RBAC refuses it, the login page shows "Missing permission: any (no role assigned)", and that's the end. Plugin loading would come after that, so it never runs. Same result on 1.1.3 and on this branch. The only change is that a no-role account can now fetch the web plugin files directly, outside the web admin. They aren't secret, so it's harmless, just pointless. The mocked tests answer "who am I?" for everyone, so login always succeeds there and they don't catch it.

   What's it for? If nothing, drop the four entries and the README sentence. If you want no-role users to land in an empty app instead of the login error, "who am I?" (getCurrentUser) has to be let through too, and that's a bigger call. The login message already tells them what's wrong.

2. Two of the four entries are plain names, getWebPluginPaths and getWebPluginResource, that don't exist in 4.6.0. They're for your engine PR, OpenIntegrationEngine/engine#336. The comment just says "native engine servlet", so the next person sees exceptions for things that don't exist and can't tell why. Name engine#336 in the comment.