UI: expose network ACL replacement from VPC tiers - #13794

Summary

Expose the existing replaceNetworkACLList operation directly from the VPC tiers overview.

This is an additional UI entry point. The existing replace-ACL action on an individual tier's detail page remains unchanged.

Scope

• VPC tiers UI only
• Uses the existing replaceNetworkACLList API
• No server, API, database schema, or ACL-semantics changes
• No workflow or CI configuration changes
• ACL choices are loaded for the VPC that owns the selected tier
• The action is disabled when replaceNetworkACLList is unavailable to the current user
• Existing default-allow/default-deny warnings and asynchronous-job feedback are reused

Behaviour

A replace-ACL action is shown beside the current ACL for each tier in the VPC tiers overview.

Selecting the action opens a dedicated replacement modal preselected with the tier's current ACL.

The replacement flow has its own:

• form reference;
• form data;
• validation rules;
• ACL list;
• selected ACL;
• target tier identifier;
• fetch loading state;
• submission loading state;
• interaction generation.

It does not reuse or mutate the create-tier form state.

showReplaceAclModal remains the boolean modal-visibility state.

handleOpenReplaceAclModal() starts a replacement interaction, captures the owning VPC identifier, initializes replacement-only state, and loads the ACL lists belonging to that VPC.

handleCloseReplaceAclModal() handles user cancellation. It hides the modal, invalidates the cancelled interaction, and clears replacement-only state so a pending request cannot later update a closed or newer interaction.

A validated submission hides the modal without invoking the cancellation handler, allowing the already captured operation to continue.

Each interaction is protected by its generation and owning VPC identifier. Closing the modal, opening another tier, or navigating to another VPC invalidates older ACL-list and validation completions.

This prevents stale asynchronous work from:

• overwriting a newer tier's ACL list or selection;
• mutating the create-tier form;
• submitting after the interaction has been cancelled;
• clearing the loading state of a newer interaction.

Before submission, the selected ACL, owning VPC, target tier, interaction generation, and form reference are captured for that operation.

The encoded request uses the existing API parameters:

• aclid;
• networkid.

An older submission completing after another replacement interaction has started continues to report its own captured tier identifier and cannot clear the newer interaction's loading state.

Successful asynchronous completion refreshes the VPC view through the existing parentFetchData callback.

The existing create-tier ACL-loading and selection path remains unchanged.

Validation

Focused tests in VpcTiersTab.spec.js cover:

• a closed replacement request not mutating create-tier state;
• an older tier ACL response not overwriting a newer tier interaction;
• stale responses being ignored when the parent VPC changes;
• the replacement interaction closing when the parent VPC changes;
• cancellation while form validation is pending;
• cancelled validation not submitting an API request;
• captured ACL and tier identifiers across overlapping submissions;
• an older submission completion not clearing a newer interaction's loading state;
• the replacement form reference remaining outside reactive data();
• the mounted template populating the replacement form reference before submission;
• the encoded POST payload containing the selected aclid and captured networkid;
• the asynchronous-job notification using the captured tier identifier;
• the overview replacement action remaining disabled without API permission.

The shallow-mounted component tests explicitly render stub default slots so the nested replacement form and overview action are present in the mounted template.

The current-head repository checks should be reviewed before merge.