Adds three top-nav areas to the UC UI:
- External Data: two tabs (External Locations / Credentials) with list +
  detail pages. Credential detail shows type (Aliyun STS / Aliyun static
  AK/SK / AWS IAM), a masked access-key id (the secret is never returned by
  the API), the STS trust-policy hint, and "used by" locations. Location
  detail links back to its credential. Both support Create (secret entered
  via a password field; server enforces CREATE_STORAGE_CREDENTIAL /
  CREATE_EXTERNAL_LOCATION and its 403 is surfaced verbatim).
- A per-credential Validate action vends temporary PATH_READ credentials for
  a bound external location, probing the real vend path; the notification is
  scoped to the exact path probed.
- Users: SCIM user list (search by name OR email) with a detail drawer, Create
  User, and a per-user permissions view. A Grant/Revoke UI (securable- and
  user-scoped) rounds out permission management.

Shared infra used across these lists:
- ListLayout paginates client-side with a 20/50/100 page-size selector
  (default 20) and renders a failed load as an alert instead of an empty
  table; an optional searchText accessor lets Users search email too.
- List hooks follow pagination to the end (credentials/external-locations via
  next_page_token, SCIM users via startIndex) so nothing is silently
  truncated at the server's page cap.
- openapi route() percent-encodes path params (names with '/', '%', ...) via a
  function replacer, and the per-user permissions query filters assignments to
  the target principal client-side (the server ignores ?principal) and
  surfaces a total failure as an error rather than "no privileges".
- Queries no longer retry (a 401/403/404 is deterministic; retries only
  delayed the error state).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

- L1 unit tests: credential type/mask helpers, external-location longest-prefix
  matching + storage-path join, and Spark column-type mapping.
- L2 component tests: every create modal (payload contract per credential
  type, SCIM user body, external-location binding, create-table columns/
  storage_location), grant (changes add/remove shape + %xx% user filter), and
  the validate button (disabled without a bound location, PATH_READ payload,
  success/error notifications). The HTTP layer is fully mocked (jest.mock of
  the axios CLIENT) — no server, no cloud, no credentials.
- Jest infra: a providers renderer, a mock-client router asserting request
  payloads, antd interaction helpers, and setupTests polyfills (matchMedia,
  getComputedStyle guard, scrollbar-size + antd/es->lib mapping, axios ESM->CJS
  mapping) plus a notification teardown so a prior test's toast can't satisfy a
  later query. package.json/yarn.lock pinned so --frozen-lockfile passes.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>