Address review of #41133:
- Reuse the dashboard can_export permission for export_xlsx via
method_permission_name instead of the inert @permission_name decorator,
which FAB ignored and which derived an unassigned can_export_xlsx perm
that the frontend never checks. Drop the decorator and the stale test
assertion; add a regression test proving a can_export-only role is
admitted (202) not rejected (403).
- Reject mode="images" with 404 when the webdriver screenshot flags are
off, mirroring the UI gate and validate_feature_flags behavior; add
flag-on/off regression tests.
- Frontend: distinguish the throttle 202 (no job_id) from a real enqueue
and show an "already in progress" toast instead of the misleading
"being prepared" one.
- Drop personal verification scaffolding (VERIFY_EXCEL_EXPORT.md,
docker-compose-excel-verify.yml) and revert the check-yaml exclusion
that only that compose file required.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
210dd228c5