fix(developers): add Mattermost team membership and role-aware Gitea provisioning

New users are now added to the SilverLABS Mattermost team after account
creation. Gitea provisioning is skipped for Testers (only Developers get
repo access). Role is parsed from ticket description and threaded through
the entire approval/confirmation flow. Gitea API token is now configured.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

BlazorApp/Services/ProvisioningService.cs

@@ -12,6 +12,7 @@ public record PendingDeployment(
     string Email,
     string FullName,
     string TicketId,
+    string? Role,
     DateTime CreatedAt,
     DateTime ExpiresAt);
 
@@ -35,7 +36,7 @@ public class ProvisioningService
 
     // --- Token management ---
 
-    public PendingDeployment CreatePendingDeployment(string username, string email, string fullName, string ticketId)
+    public PendingDeployment CreatePendingDeployment(string username, string email, string fullName, string ticketId, string? role = null)
     {
         CleanupExpiredTokens();
 
@@ -43,7 +44,7 @@ public class ProvisioningService
             .Replace("+", "-").Replace("/", "_").TrimEnd('=');
 
         var deployment = new PendingDeployment(
-            token, username, email, fullName, ticketId,
+            token, username, email, fullName, ticketId, role,
             DateTime.UtcNow, DateTime.UtcNow.AddHours(48));
 
         _pendingDeployments[token] = deployment;
@@ -113,7 +114,7 @@ public class ProvisioningService
     // --- Full provisioning with password ---
 
     public async Task<(bool Success, string Message)> ProvisionWithPasswordAsync(
-        string ticketId, string username, string email, string fullName, string password)
+        string ticketId, string username, string email, string fullName, string password, string? role = null)
     {
         var results = new List<string>();
         var allSuccess = true;
@@ -123,15 +124,32 @@ public class ProvisioningService
         results.Add($"Mattermost: {mmMsg}");
         if (!mmOk) allSuccess = false;
 
+        // 1b. Add to SilverLABS team (only if user was created)
+        if (mmOk)
+        {
+            var (teamOk, teamMsg) = await AddMattermostUserToTeamAsync(username);
+            results.Add($"Mattermost Team: {teamMsg}");
+            if (!teamOk) allSuccess = false;
+        }
+
         // 2. Create Mailcow mailbox
         var (mailOk, mailMsg) = await CreateMailcowMailboxAsync(username, fullName, password);
         results.Add($"Mailcow: {mailMsg}");
         if (!mailOk) allSuccess = false;
 
-        // 3. Create Gitea user
-        var (giteaOk, giteaMsg) = await CreateGiteaUserAsync(username, email, fullName, password);
-        results.Add($"Gitea: {giteaMsg}");
-        if (!giteaOk) allSuccess = false;
+        // 3. Create Gitea user (Developers only)
+        var giteaOk = false;
+        if (string.Equals(role, "Developer", StringComparison.OrdinalIgnoreCase))
+        {
+            var (gOk, giteaMsg) = await CreateGiteaUserAsync(username, email, fullName, password);
+            giteaOk = gOk;
+            results.Add($"Gitea: {giteaMsg}");
+            if (!giteaOk) allSuccess = false;
+        }
+        else
+        {
+            results.Add("Gitea: Skipped (not required for Tester role)");
+        }
 
         // 4. Update the DeveloperApplication record in SilverDESK
         var (updateOk, updateMsg) = await UpdateApplicationStatusAsync(ticketId, mmOk, mailOk, giteaOk);
@@ -318,6 +336,39 @@ public class ProvisioningService
         }
     }
 
+    private async Task<(bool Success, string Message)> AddMattermostUserToTeamAsync(string username)
+    {
+        try
+        {
+            var client = _httpClientFactory.CreateClient("Mattermost");
+
+            // Look up user ID by username
+            var userResponse = await client.GetAsync($"/api/v4/users/username/{username}");
+            if (!userResponse.IsSuccessStatusCode)
+                return (false, $"User lookup failed ({userResponse.StatusCode})");
+
+            var userData = await userResponse.Content.ReadFromJsonAsync<JsonElement>();
+            var userId = userData.GetProperty("id").GetString();
+
+            // Add to SilverLABS team
+            var teamId = _configuration["Mattermost:TeamId"] ?? "ear83bc7nprzpe878ey7hxza7h";
+            var payload = new { team_id = teamId, user_id = userId };
+            var response = await client.PostAsJsonAsync($"/api/v4/teams/{teamId}/members", payload);
+
+            if (response.IsSuccessStatusCode)
+                return (true, "Added to team");
+
+            var body = await response.Content.ReadAsStringAsync();
+            _logger.LogError("Mattermost team join failed: {Status} {Body}", response.StatusCode, body);
+            return (false, $"Team join failed ({response.StatusCode})");
+        }
+        catch (Exception ex)
+        {
+            _logger.LogError(ex, "Mattermost team join error for {Username}", username);
+            return (false, $"Error: {ex.Message}");
+        }
+    }
+
     private async Task<(bool Success, string Message)> CreateMailcowMailboxAsync(
         string username, string fullName, string password)
     {