fix(configurator): explain server-side Apply availability

[lweberru]

What changes

• Surface expected server-side Apply eligibility blockers, including field-level execution capability restrictions, in both Plan and Apply phases.
• Keep a blocked Apply action visible and disabled instead of silently removing it. Eligible plans still require unchecked explicit approval and the exact target organization UUID.
• Stop swallowing unexpected eligibility failures; the existing API handler logs a private generic event and returns service_unavailable.
• Document the intentional Firewall/HA Plan-only boundary and link the remaining qualification work in Configurator MVP: execute supported configurations from the common editor #89.

Safety and scope

No authorization, tenant isolation, source/revision, credential, artifact, state, runner-package or approval checks were relaxed. No customer Apply, cloud deployment or production acceptance was performed. The exact denial reason of the reported customer run is not yet verified; Firewall/HA is a known gate, not an asserted diagnosis. This is a diagnostics/approval-UX fix, not new Firewall Apply capability. Does not close #89.

Validation

• Pinned Node 24.21.0 / npm 11.19.0.
• npm run check: successful; 809 unit tests passed, 66 environment-dependent tests skipped; static Assistant freshness, lint, type-check and production build passed.
• npm run test:platform-database: 60/60 passed against isolated disposable PostgreSQL, including allowed approval, Firewall denial, credential denial, expiry and unexpected dependency errors.
• Playwright explicit saved-plan approval suite: 88/88 passed across desktop/mobile, including both phases, DE/EN, reload, disabled action, exact approval and no implicit mutations.
• git diff --check passed.

The first browser run caught a placement bug and obsolete absent-button expectations; these were fixed before the complete selected suite passed. Browser external API responses are mocked; PostgreSQL integration validates the actual eligibility flow separately. Hosted behavior has not been changed by this PR.

[lweberru]

Activated and verified in Development via manual release 38986171056, exact API/Runner source 3ab7bfaa92236fc4a4242028a27a901df0c1496d (follow-ups #110–#114 included). All release gates passed; hosted smoke 5/5 verifies both viewport blocker/approval flows and direct load/reload. API responses in the Apply UI checks are synthetic and all execution writes are forbidden; no customer Apply was run. Existing capability restrictions remain. Operational follow-up is documented in #90/#95.