fix(ui): distinguish registry authentication from chart readiness

[thbertoldi]

Problem

Kubeflow, LiteLLM and Qdrant share the SUSE AI Registry ClusterRepo. Opening their install wizard before Rancher has downloaded its index can surface Failed to initialize: configmaps "" not found. Static catalog entries and direct wizard links can reach this state even though dynamic catalog discovery already checks readiness.

Settings previously reported only the operator's direct registry authentication probe. That can succeed while Rancher's ClusterRepo is disconnected: it does not validate chart-path access, Rancher's mirrored credentials, or its downloaded index.

Changes

• Keep the wizard readiness guard: check the index ConfigMap and download conditions before chart/version lookup, preserve metadata errors, and show the actual repository failure instead of requesting an unavailable index.
• Show separate authentication and chart repository results in all three registry Settings sections. Report ready, pending, missing and failed states, Rancher's condition message, and links to the management cluster's native repository pages. Permission/network errors are not reported as missing repositories.
• Distinguish current form inputs from freshly read saved settings. Clear stale authentication results after edits and discard diagnostics after Apply. Do not silently authenticate saved credentials when fields are cleared; explicitly probe connected endpoint defaults and explain when a removed CA must be applied before the operator can test it.
• Keep Test read-only. Add an explicit per-repository Refresh that rechecks ownership, uses a resourceVersion-guarded spec.forceUpdate patch, and does not save form values or modify Secrets. Acceptance is shown as pending; Test again checks the resulting download. No automatic refresh or polling.
• Check Settings/ClusterRepo generation freshness to avoid presenting an old index as successful reconciliation. Include both NVIDIA aliases and managed team repositories, including private mirrors, without adopting unrelated repositories by URL.
• Add service regression tests and real Vue component interaction tests, with minimal Vue/jsdom test support. Exclude Rancher's temporary .shell build link from test discovery.

Validation

• yarn install --frozen-lockfile --ignore-engines --non-interactive: passed.
• yarn test --silent: 210 tests passed, including 17 wizard regressions and 63 new Settings/service cases.
• yarn lint --quiet and yarn typecheck: passed.
• yarn build-pkg aif-ui: passed with webpack bundle-size warnings.
• Pre-commit checks on changed files: passed.

Live verification still needed

1. With a disconnected SUSE ClusterRepo and working registry login, Test should show authentication success and the repository failure/reason.
2. Edit the endpoint or credential/CA references without applying; check the saved-settings warning and stale authentication handling.
3. Click Refresh, confirm pending rather than ready, then Test again after Rancher processes the request. A successful download should become ready; a failed download should show its current reason.
4. Retry the affected app wizard once the repository is ready.

Validation uses simulated operator/Rancher responses; no live cluster was changed. The customer's underlying SUSE registry download failure is still unverified. This PR improves readiness checks, diagnosis and explicit retry; it does not claim to fix registry entitlement, networking or Rancher reconciliation failures.