feat(cmdb-import): show the import mapping read-only in the CMDB import section

[WilcoLouwerse]

What

An admin can now see, read-only, the column mapping the CMDB import really uses, inside the existing CMDB import section of the stackiq admin settings.

• New endpoint GET /api/settings/cmdb-import/mapping (admin only, CSRF). It loads the import profile and its five packs (module, manufacturer, municipality, usage, businessOwner) through CmdbImportProfile, the same loader the import uses, so the answer is what the next import runs. Success is the flat {profile, packs}; a broken pack answers 503 MAPPING_UNAVAILABLE with the loader's reason (file names and validator rules only).
• CmdbImport.vue gets a collapsible block Mapping (read-only) (CmdbImportMapping.vue): the sheets, key column and required columns, then one table per pack with source column → target field, required, transformation and lookup values. The sheet names in the section's help text now come from the endpoint, with the shipped defaults as fallback.
• Editing stays file-based; docs/features/cmdb-import.md gets "Viewing the mapping".
• OpenSpec change cmdb-import-mapping-view (ADDED REQ-CMDB-020, MODIFIED REQ-CMDB-014).

Jira: WOO-588 (sub-task of WOO-586). Plan: WOO-588 plan. Review and merge are tracked in WOO-590.

Overlap with the WOO-587 PR

The WOO-587 PR (archive and soft-delete on a CMDB re-import) touches the same files: CmdbImport.vue (one import line), openspec/specs/cmdb-export-import/spec.md (one line in the changes list), and l10n. A local merge of both branches on development had two trivial conflicts (keep both sides). It passed jest (190), the CMDB PHPUnit suites (328 tests) and the two new vitest specs. Whichever PR merges second needs development merged in.

Tests

Check	Result
PHPUnit SettingsControllerCmdbImportMappingTest + CmdbImportProfileTest	✅ pass (48 tests across the controller suite)
jest	✅ 11 suites, 184 tests
vitest cmdbImportMapping.spec.js	✅ 7 tests
full vitest	⚠️ 6 failures, the same 6 as on development c75dbb2 (connectionsPages, maintenance, settingsInfoPanels ×2, usages ×2, shared-instance); not touched here
phpcs / php lint / phpstan	✅ 0 errors
eslint / prettier / l10n / check:l10n-js / manifest / schema-l10n / vue-demi	✅
psalm	❓ could not run locally: psalm crashes while scanning vendor ($value must be a scalar); CI is the evidence
full composer test:unit locally	⚠️ 20 errors, all in Repair/PortfolioReport tests (missing Doctrine/Symfony classes in the local vendor), outside this diff
Playwright tests/e2e/spec-coverage/cmdb-import-mapping.spec.ts	written, not run locally

Rig check, Nextcloud 35.0.1 with the beta releases of OpenRegister 2.1.37, OpenCatalogi 2.1.18, Portaliq 0.2.9 and Thematiq 1.2.26, and stackiq = this branch merged with the WOO-587 branch:

Check	Result
GET /api/settings/cmdb-import/mapping as admin	200, five packs, two sheets
The same request as a non-admin	403

🤖 Generated with Claude Code

[github-actions]

Quality Report — ConductionNL/stackiq @ 8daa1a7

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
check-vue-demi		✅
test-l10n		✅
format		✅
check-schema-l10n		✅
check-l10n-js		✅
composer			✅	✅ 133/133
npm			✅	✅ 807/807
app:check-code	⏭️
info.xml	✅
REUSE	❌
lockfile sync		✅
PHPUnit					✅ 1230/1230 · 20 skipped
Newman					⏭️
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it locally with npx playwright test, or from the Actions tab on a branch with no open pull request into development.
Hydra gates					✅

---

Quality workflow — 2026-10-09 14:57 UTC

Download the full PDF report from the workflow artifacts.