fix(i18n): translate SSO/SCIM/user-position/import-job admin objects

[os-zhuang]

What

An audit following the bundle-ownership guard rollout (#3502) found live, registered, UI-facing system objects that were never added to their package's i18n-extract.config.ts and carried no translation bundle entry — so non-English admins saw raw English label metadata. The orphan-only guards from #3502 catch stray bundle keys, not owned-and-live-but-never-extracted objects, so this gap was invisible.

This adds i18n coverage for four such objects, with real zh-CN / ja-JP / es-ES translations (not --fill=default English placeholders):

Object	Package	UI surface
sys_sso_provider	platform-objects	listViews + Register SSO/SAML + Verify-Domain actions
sys_scim_provider	platform-objects	admin grid
sys_user_position	plugin-security	userActions create/edit/delete (sibling sys_user_permission_set already translated)
sys_import_job	platform-objects	Import-Wizard history / Setup import grid / dashboards

The three verified-internal objects (sys_approval_approver, sys_approval_token, sys_audience_binding_suggestion) are correctly left untranslated.

sys_import_job — why included

Lower-confidence at audit time (engine-owned, view-only, no listViews). Confirmed genuinely UI-surfaced: the objectui @object-ui/plugin-grid Import Wizard has a real import-history view (importHistory.test.ts, isImportJobActive/isImportJobUndoable), its own docstring names the Setup import grid + dashboards, and its structurally-identical siblings sys_job / sys_job_run are already translated. Leaving it out would reproduce the very sibling-inconsistency this audit fixes.

How

Per object: added the schema to its package's extract config (import + objects[]), added the translation block to all four locale bundles, and extended the bundle-ownership.test.ts OWNED_OBJECTS. English blocks were tool-scaffolded via os i18n extract (proven regen-stable — a no-op run on the unmodified config produced a 0-line diff), then non-English leaves were hand-translated. Out-of-scope metadata-forms regen and pre-existing plugin-security object drift were reverted so the diff is exactly these four objects.

Verify

• pnpm turbo test --filter=@objectstack/platform-objects --filter=@objectstack/plugin-security — green (both ownership guards pass; platform-objects guard re-run fresh to rule out cache)
• pnpm turbo build --filter=... --force — green, DTS type-check active (OS_SKIP_DTS unset) → bundles are valid TranslationData
• Structural parity confirmed across all four locales for every object; non-English strings differ from English except intentional keep-tokens (ID, OAuth/SAML placeholders, urn: NameID format)

Single patch changeset (both packages share one fixed group).

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
spec	Building	Preview, Comment	Jul 27, 2026 2:42am

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/platform-objects, @objectstack/plugin-security.

12 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:

• content/docs/deployment/cli.mdx (via @objectstack/plugin-security)
• content/docs/permissions/access-recipes.mdx (via packages/plugins/plugin-security)
• content/docs/permissions/authorization.mdx (via @objectstack/plugin-security)
• content/docs/permissions/explain.mdx (via @objectstack/plugin-security)
• content/docs/permissions/permissions-matrix.mdx (via packages/plugins/plugin-security)
• content/docs/permissions/sharing-rules.mdx (via @objectstack/plugin-security)
• content/docs/plugins/index.mdx (via @objectstack/plugin-security)
• content/docs/plugins/packages.mdx (via @objectstack/platform-objects, @objectstack/plugin-security)
• content/docs/releases/implementation-status.mdx (via @objectstack/plugin-security)
• content/docs/ui/audience-based-interfaces.mdx (via packages/plugins/plugin-security)
• content/docs/ui/dashboards.mdx (via @objectstack/plugin-security)
• content/docs/ui/setup-app.mdx (via @objectstack/platform-objects)

Advisory only. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs origin/main → pass the list as args.docs.