feat: basic UI for merging sandboxes

[elias-ba]

Description

This PR adds UI for the sandbox merging features to allow users to consolidate their work by merging one sandbox into another. This enables a Git-like workflow where developers can experiment in isolated sandboxes and then merge their changes back into a parent or sibling project.

Key Features

• Merge any sandbox into its parent or sibling projects (not descendants)
• Automatically closes the source sandbox after successful merge
• Merges all workflows from source to target using existing MergeProjects module
• Smart target selection with parent project as default
• New merge button with branch icon on each sandbox card
• Modal dialog with clear merge flow and target selection
• Real-time feedback on merge impact and affected sandboxes
• Descendant warnings: Shows which child sandboxes will be closed when merging
• Beta warning: Reminds users this is a beta feature and suggests using CLI for production
• Follows existing sandbox permission model (owners and admins only)

Closes #3426 #3744

Validation Steps

Basic Merge Flow

1. Create a root project with at least 2 sandbox children
2. As an owner, navigate to Sandboxes page
3. Click the merge button (branch icon) on any sandbox
4. Verify modal opens with:
   • Source sandbox name displayed
   • Parent project selected by default
   • All valid targets listed (parent + siblings, excluding descendants)
5. Submit the merge
6. Verify redirect to root project workflows page
7. Verify success message and sandbox is deleted

Descendant Warnings

1. Create a hierarchy: root -> child1 -> grandchild1
2. Open merge modal for child1
3. Verify single descendant warning appears mentioning grandchild1
4. Create another grandchild: root -> child1 -> grandchild2
5. Open merge modal for child1 again
6. Verify multi-descendant warning with full list of both grandchildren

Deep Nesting

1. Create: root -> child -> grandchild -> great-grandchild
2. Open merge modal for child
3. Verify all descendants (grandchild + great-grandchild) are listed in warning
4. Verify target dropdown excludes all descendants

Authorization

1. As a viewer, navigate to Sandboxes page
2. Verify merge button is:
   • Disabled (cursor-not-allowed style)
   • Shows tooltip: "You are not authorized to merge this sandbox"
3. Verify cannot open modal (server rejects with error flash)
4. As an owner, verify merge button is enabled and functional

Edge Cases

1. No siblings: Open merge modal on an only-child sandbox
   • Verify only parent appears in target dropdown
2. Multiple target options: Verify dropdown shows parent + all siblings
3. Merge error handling: Mock an import failure
   • Verify error message appears
   • Verify modal closes
   • Verify sandbox is not deleted

Additional Notes for the Reviewer

Design Decisions

1. Why close descendants? When merging a sandbox, its descendants lose their parent context. Rather than orphaning them or moving them, we close them and warn the user to merge children first if they want to preserve that work.

2. Why only parent/siblings? Merging into a descendant would create a circular dependency in the project hierarchy. This restriction keeps the tree structure valid.

3. Authorization follows update/delete Merge is a destructive operation (deletes source sandbox) and modifies the target, so it requires the same permissions as update/delete operations.

Known Limitations

• No preview: Users cannot preview changes before merging (CLI workflow recommended for production)
• No undo: Merge is permanent and cannot be rolled back

AI Usage

Please disclose how you've used AI in this work (it's cool, we just want to know!):

• Code generation (copilot but not intellisense)
• Learning or fact checking
• Strategy / design
• Optimisation / refactoring
• Translation / spellchecking / doc gen
• Other
• I have not used AI

You can read more details in our Responsible AI Policy

Pre-submission Checklist

• I have performed a self-review of my code.
• I have implemented and tested all related authorization policies. (:owner and :admin can merge; :viewer cannot)
• I have updated the changelog.
• I have ticked a box in "AI usage" in this PR

[codecov]

Codecov Report

❌ Patch coverage is 97.50000% with 6 lines in your changes missing coverage. Please review.
✅ Project coverage is 88.41%. Comparing base (f431e82) to head (37d8cf1).

Files with missing lines	Patch %	Lines
lib/lightning_web/live/sandbox_live/index.ex	96.90%	3 Missing ⚠️
.../lightning_web/live/sandbox_live/form_component.ex	92.85%	2 Missing ⚠️
lib/lightning_web/live/sandbox_live/components.ex	98.87%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3741      +/-   ##
==========================================
+ Coverage   88.35%   88.41%   +0.05%     
==========================================
  Files         414      414              
  Lines       17756    17895     +139     
==========================================
+ Hits        15689    15822     +133     
- Misses       2067     2073       +6     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.