Fix group and public workspace dashboard counts

[Paul Lizer (paullizer)]

Summary

• Group and public workspace dashboards used the shared overview without supplying counts, unlike My workspace. Wire available resource cards to explicit, authorized workspace readers, including Members where permitted.
• Use server-authoritative totals for paginated Documents, Prompts and Members; keep zero counts visible and show a small accessible red circled X for individual failures without hiding successful counts.
• Abort obsolete reads, prevent stale viewer/workspace results, and refresh on returning to Overview or access revalidation. Preserve My workspace behavior and existing locked cards.
• Add production-reader and real-SPA regressions, update scoped fixtures and guides, and bump the application to 0.261.310. Public Members counts describe the management roster, not all readers; non-roster readers do not request that count.

Linked issue

N/A. The user chose to proceed without creating an issue.

Release Notes & Latest Features

• New Feature
• Bug Fix
• UI Enhancement
• Breaking Change
• Internal only

Is this visible to end users?

• Yes
• No

Is this admin-facing (Admin Settings, governance, deployment, config)?

• Yes
• No

Should this become a Latest Feature card?

• Yes
• No
• Already added

Screenshot needed for the card?

• Yes
• No
• Attached

Release notes were offered but left unchanged pending user approval. No Latest Feature card is proposed for this parity fix.

Version bump

• application/single_app/config.py VERSION third segment bumped, or not needed because this is docs-only
• deployers/version.txt bumped, or not needed because deployers/ was not changed

Application version: 0.261.309 -> 0.261.310. No deployer changes.

Testing / validation

• npm --prefix .\application\v2_ui run build - passed TypeScript and production Vite build; existing bundle-size warning remains.
• node .\functional_tests\test_v2_shared_workspace_counts.mjs - passed production-reader count contracts, including totals beyond 500, zero/malformed results, partial failure, cancellation, delegation-only actions, and public reader membership gating.
• node .\functional_tests\test_v2_workspace_sections_logic.mjs - passed 12 checks.
• node .\functional_tests\test_v2_group_workspace_context_logic.mjs - passed 30 checks.
• node .\functional_tests\test_v2_public_workspace_context_logic.mjs - passed 4 checks.
• With $env:PYTHONPATH = "$PWD\ui_tests\fixtures;$PWD", python -m pytest .\ui_tests\test_v2_shared_workspace_overview_counts.py .\ui_tests\test_v2_group_workspace_shell.py .\ui_tests\test_v2_public_journeys.py -q --browser chromium --maxfail=2 - 79 passed, 1 failed. All 18 new count cases passed in local Chromium through the Azure-compatible connection fixture, including light/dark desktop/mobile layouts, delayed workspace switches, refresh and failure indicators. The remaining existing public journey expects immediate deployment-wide feature activation on focus and conflicts with the unchanged bootstrap refresh cooldown.
• With the same fixture import path, python -m pytest .\ui_tests\test_v2_public_journeys.py -k settings_activation -q --browser chromium --maxfail=1 - reproduced that existing activation failure in isolation. No unrelated bootstrap behavior was changed.
• python -m pytest .\functional_tests\test_v2_workspace_sections.py .\functional_tests\test_v2_group_prompts_seam.py -q - 15 passed.
• python -m pytest .\functional_tests\test_v2_workspace_sections.py .\functional_tests\test_v2_group_workspace_context.py .\functional_tests\test_group_identity_transport.py .\functional_tests\test_public_identity_transport.py .\functional_tests\test_v2_group_prompts_seam.py -q - legacy Flask-backed checks were blocked by the installed Flask test client accessing missing werkzeug.__version__.
• python -m pytest .\functional_tests\test_v2_workspace_sections.py .\functional_tests\test_v2_group_prompts_seam.py .\functional_tests\test_public_membership_fixture_parity.py -q - 28 passed; 4 failures and 57 setup errors shared that Flask/Werkzeug compatibility blocker.
• python .\functional_tests\test_docs_app_surface_coverage.py - passed 7 checks; committed inventory remains current.
• python .\functional_tests\test_docs_site_quality.py - passed 6 checks.
• git -c core.whitespace=blank-at-eol,blank-at-eof,space-before-tab,cr-at-eol diff --check - passed.

No live Azure services or authenticated production workspace writes were used for validation.

Documentation

• Release notes updated, or not needed
• Feature documentation updated, or not needed
• Fix documentation updated, or not needed

Updated group/public user guides and added docs/explanation/fixes/SHARED_WORKSPACE_OVERVIEW_COUNTS_FIX.md, including exact scope semantics and validation limitations. No new setting, route, migration, or dependency.

Security checklist

• New Flask routes include @swagger_route(security=get_auth_security())
• Settings sent to non-admin frontends use sanitize_settings_for_user()
• Browser JavaScript is served from local SimpleChat static assets only; no CDN-hosted JS
• No secrets, keys, connection strings, or local-only artifacts are included

No Flask routes or frontend settings payloads were added or changed. Reads remain explicitly scoped and use existing authorization boundaries; disabled resources are not fetched and no personal/admin resource fallback is introduced.