feat: [PLAT-5936] Allow-list support for private studios

[sabulous]

Description

Ticket: PLAT-5936

This PR adds CLI support for the private-studio allow list — the users, besides the creator, who may connect to and start a private studio.

Changes

• Set the list on add — Set the allowed user when creating a private studio with the --allow-user <user> option (available on add, add-as-new, and start), where <user> is a numeric user ID, username, or email. The platform currently caps the allow list at a single additional user, so the option takes a single value.

  tw studios add -n my-studio -w my-workspace -c my-ce -t <template> --private --allow-user <user>

• Name/email resolution — a non-numeric --allow-user value is resolved to a user ID by looking it up among the organization's members and then its collaborators (a workspace participant may be either). A numeric value is used directly. The backend still enforces that the resolved user is a workspace participant.

• Override the list on start — start --allow-user replaces the existing allow list; omit it to leave the list unchanged. Only the studio creator may change it.
  Note: the override only applies when the studio is startable (stopped) — starting an already-running studio won't change the list.

  tw studios start -w my-workspace -n my-studio --allow-user <user>

• Studio view shows the allow list — the studio view now includes an Allowed users row.

• Lookup-by-name returns full detail — view -n (and start/update by name) now fetch the full studio via describe after resolving the name, so name-based lookups match id-based ones (the list response omits allowedUsers).

  tw studios view -w my-workspace -n my-studio

Example cli testing session with various cases

Setup: These are real runs against a local backend, workspace hello1 / 1-wsp. The studio cli-priv-1 is created by user sab. 21 is user nonowner and 8 is user permiss, both workspace members. 21 is added to the allow list at creation; 8 replaces it later via start.

Create a private studio with an allowed user (by id)

$ tw studios add -w 152937999146850 -n cli-priv-1 -t cr.seqera.io/public/data-studio-jupyter:4.2.5-snapshot -c nwelocal --private --allow-user 21

  Studio 9def339e CREATED at [hello1 / 1-wsp] workspace.

The allowed user can also be given by username or email

$ tw studios add -w 152937999146850 -n cli-priv-name -t cr.seqera.io/public/data-studio-jupyter:4.2.5-snapshot -c nwelocal --private --allow-user nonowner@seqera.io

  Studio a1b2c3d4 CREATED at [hello1 / 1-wsp] workspace.

# 'nonowner@seqera.io' (equivalently the username 'nonowner') resolves to user id 21.

Reject at the CLI: --allow-user given more than once

$ tw studios add -w 152937999146850 -n cli-priv-dup -t cr.seqera.io/public/data-studio-jupyter:4.2.5-snapshot -c nwelocal --private --allow-user 21 --allow-user 8

 ERROR: option '--allow-user' (<allowedUser>) should be specified only once

# the platform caps the allow list at one additional user, so the CLI accepts a single value.

Reject: a user who is not a member of the workspace

$ tw studios add -w 152937999146850 -n cli-priv-bad -t cr.seqera.io/public/data-studio-jupyter:4.2.5-snapshot -c nwelocal --private --allow-user 999999

 ERROR: One or more specified users are not members of this workspace.

Replace the allowed user on start (creator only; studio must be stopped [user 8 below is permiss@seqera.io])

$ tw studios start -w 152937999146850 -n cli-priv-1 --allow-user 8

  Studio cli-priv-1 START successfully submitted at [hello1 / 1-wsp] workspace.

$ tw studios view -w 152937999146850 -n cli-priv-1

  Studio at workspace '[hello1 / 1-wsp]'
 ---------------------+------------------------------------------------
  SessionID           | 9def339e
  Name                | cli-priv-1
  Status              | STARTING
  Created by          | sab | sab@seqera.io
  Allowed users       | permiss | permiss@seqera.io
  ...

Start without --allow-user leaves the list unchanged

$ tw studios stop -w 152937999146850 -n cli-priv-1
  Studio cli-priv-1 STOP successfully submitted at [hello1 / 1-wsp] workspace.

# after it reaches STOPPED:
$ tw studios start -w 152937999146850 -n cli-priv-1
  Studio cli-priv-1 START successfully submitted at [hello1 / 1-wsp] workspace.

$ tw studios view -w 152937999146850 -n cli-priv-1
  ...
  Allowed users       | permiss | permiss@seqera.io   # unchanged

[georgi-seqera]

awesome, looks good to me 👍