feat: Script Generator Phase 1+2 — backend, engine, API, frontend, template editor, parameter detector

Complete Script Generator feature including:

Backend:
- ScriptCategory, ScriptTemplate, ScriptGeneration models
- ScriptTemplateEngine with substitution, filters, sanitization
- CRUD + share API endpoints with permission checks
- Integration tests for permissions and sharing
- Migration 057 with AD User Management seed templates

Frontend — Script Library:
- Browse templates with category tabs and search
- Configure pane with parameter form and script generation
- Script preview with live substitution and copy/download
- scriptGeneratorStore Zustand store

Frontend — Template Editor:
- Full CRUD form with metadata, script body (Monaco Editor), parameters
- ParameterSchemaBuilder with visual builder + JSON toggle
- ScriptManagePage with routing and nav link

Frontend — Parameter Detector:
- Client-side PowerShell parameter detection engine
- Detects script-level param() blocks and variable assignments
- Type inference from PS type annotations and value patterns
- ParameterDetectorStepper one-by-one review UI with accept/skip

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

frontend/src/types/index.ts

@@ -87,3 +87,5 @@ export type {
   KBCommitResponse,
   KBQuotaResponse,
 } from './kbAccelerator'
+
+export * from './scripts'

frontend/src/types/scripts.ts

@@ -0,0 +1,137 @@
+export interface ScriptCategoryResponse {
+  id: string
+  name: string
+  slug: string
+  description: string | null
+  icon: string | null
+  sort_order: number
+  template_count: number
+}
+
+export interface ScriptTemplateListItem {
+  id: string
+  category_id: string
+  team_id: string | null
+  created_by: string | null
+  name: string
+  slug: string
+  description: string | null
+  tags: string[]
+  complexity: 'beginner' | 'intermediate' | 'advanced' // must match backend ScriptComplexity enum exactly
+  estimated_runtime: string | null
+  requires_elevation: boolean
+  requires_modules: string[]
+  is_verified: boolean
+  usage_count: number
+}
+
+export interface ScriptParameterOption {
+  value: string
+  label: string
+}
+
+export interface ScriptParameterValidation {
+  min_value?: number   // matches backend field name (not 'min')
+  max_value?: number   // matches backend field name (not 'max')
+  pattern?: string
+  min_length?: number
+  max_length?: number
+}
+
+export interface ScriptParameter {
+  key: string
+  label: string
+  type: 'text' | 'password' | 'select' | 'boolean' | 'multi_text' | 'number' | 'textarea'
+  required: boolean
+  placeholder: string | null
+  group: string | null
+  order: number
+  help_text: string | null
+  options: ScriptParameterOption[] | null // for select type
+  default: string | boolean | number | null
+  validation: ScriptParameterValidation | null
+  sensitive: boolean
+}
+
+export interface ScriptParametersSchema {
+  parameters: ScriptParameter[]
+}
+
+export interface ScriptTemplateDetail extends ScriptTemplateListItem {
+  use_case: string | null
+  script_body: string
+  // NOTE: backend types this as `dict` — arrives as unknown at runtime.
+  // Always access via cast: (detail.parameters_schema as ScriptParametersSchema).parameters ?? []
+  parameters_schema: ScriptParametersSchema
+  default_values: Record<string, unknown>   // template-level metadata; not used in Phase 2
+  validation_rules: Record<string, unknown> // template-level metadata; not used in Phase 2
+  version: number
+  created_at: string
+  updated_at: string
+}
+
+export interface ScriptGenerateRequest {
+  template_id: string
+  parameters: Record<string, unknown>
+  session_id?: string // Phase 3: passed when generating inside a session
+}
+
+export interface ScriptGenerateResponse {
+  id: string        // generation UUID
+  script: string    // rendered PowerShell
+  warnings: string[]
+  metadata: {
+    template_name: string
+    template_version: number
+    requires_elevation: boolean
+    [key: string]: unknown
+  }
+}
+
+export interface ScriptGenerationRecord {
+  id: string
+  template_id: string
+  template_name: string
+  parameters_used: Record<string, unknown> // sensitive values already redacted by backend
+  created_at: string
+}
+
+export interface ScriptTemplateCreateRequest {
+  category_id: string
+  name: string
+  description?: string | null
+  use_case?: string | null
+  script_body: string
+  parameters_schema: ScriptParametersSchema
+  tags?: string[]
+  complexity?: 'beginner' | 'intermediate' | 'advanced'
+  estimated_runtime?: string | null
+  requires_elevation?: boolean
+  requires_modules?: string[]
+}
+
+export interface ScriptTemplateUpdateRequest {
+  name?: string
+  description?: string | null
+  use_case?: string | null
+  script_body?: string
+  parameters_schema?: ScriptParametersSchema
+  tags?: string[]
+  complexity?: 'beginner' | 'intermediate' | 'advanced'
+  estimated_runtime?: string | null
+  requires_elevation?: boolean
+  requires_modules?: string[]
+}
+
+export interface ParameterCandidate {
+  variableName: string
+  suggestedKey: string
+  suggestedLabel: string
+  suggestedType: ScriptParameter['type']
+  sensitive: boolean
+  defaultValue: string | boolean | number | null
+  source: 'param_block' | 'assignment'
+  lineNumber: number
+  matchedLine: string
+  inferenceReason: string
+}