Add Fleet Access page

[charliepark]

This adds a system-level access page, with a form for setting fleet-level permissions.

One enhancement we might consider: It looks like there are a few booleans — silo_admin and fleet_viewer — on the CurrentUser object coming from Omicron, but there is not a fleet_admin attribute. If we add that in Omicron, we could disable the "Add User or Group" button and other controls on the System Access page for people without a fleet_admin role.

Closes #2916

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
console	Ready	Preview	Mar 10, 2026 9:18pm

[david-crespo]

Seeing that, it does seem worth it to augment it by fetching all silos and listing the fleet role mappings from all of the ones that have it set. Probably in a modal. Not sure whether the blue info thing works — it kinda does, kinda doesn’t. We’ll have to experiment.

[david-crespo]

I could bikeshed the message copy and styling for a week, so let's get PR in without it and figure it out separately.

[david-crespo]

2cba589 is this

[david-crespo]

I'm happy with this. I like the "Any" to avoid the misreading that there is exactly one silo admin in whatever silo. 9429b8a makes sure we fall back to the ID instead of an empty cell when the assigned entity is not in the current user's silo (which is entirely possible with the fleet policy).