Restructure/frontend editor (#6404)

## Move editor under `frontend/editor/`

Pure restructure: `frontend/` becomes the workspace, `frontend/editor/`
holds
  the PDF editor. 1775 file renames + 40 wiring edits. No logic changes.

  ### Why

`frontend/` is currently the editor — its `src/`, `public/`,
`src-tauri/`,
  config files all sit at the root. Promoting `frontend/` to a
workspace and putting the editor in a sibling folder leaves room for
future
apps to drop in alongside it, sharing one `package.json` /
`node_modules` /
  lint config / Storybook.

  ### What moves

  frontend/
  ├── editor/                ← NEW: everything editor-specific
  │   ├── src/               ← was frontend/src/
  │   ├── public/            ← was frontend/public/
  │   ├── src-tauri/         ← was frontend/src-tauri/
│ ├── index.html, vite.config.ts, vitest.config.ts, playwright.config.ts
  │   ├── tsconfig*.json, tailwind.config.js, postcss.config.js
  │   ├── scripts/
  │   ├── .env, .env.desktop, .env.saas
  │   └── DeveloperGuide.md
├── package.json, package-lock.json, node_modules/ ← workspace install
  ├── eslint.config.mjs, .prettierrc, .prettierignore ← shared tooling
  ├── .gitignore
  └── README.md

  ### Wiring edits (40 files)

  - `.taskfiles/frontend.yml`, `desktop.yml`, `e2e.yml`
  - `build.gradle`, `app/core/build.gradle`
- `eslint.config.mjs`, `frontend/package.json`, `.gitignore`,
`.prettierignore`
  - `docker/frontend/Dockerfile`
  - 8 `.github/workflows/*.yml`, plus `.github/dependabot.yml`,
    `.github/config/.files.yaml`, `.github/labeler-config-srvaroa.yml`
  - `scripts/translations/**`
- Docs: `AGENTS.md`, `CLAUDE.md`, `ADDING_TOOLS.md`,
`DeveloperGuide.md`,
`WINDOWS_SIGNING.md`, `devGuide/HowToAddNewLanguage.md`,
`frontend/README.md`,
    `frontend/editor/DeveloperGuide.md`

Plus 3 renamed + edited: `editor/vite.config.ts` (env path +
node_modules
  walk-up), `editor/scripts/setup-env.mts` (renamed from `.ts` for
`import.meta.url`), `editor/scripts/build-provisioner.mjs` (resolve
src-tauri
  relative to script).

  ### Verification

  | Check | Result |
  |---|---|
  | `task frontend:typecheck:all` (6 variants) | exit 0 |
  | `task frontend:lint` (eslint + dpdm) | exit 0 |
  | `task frontend:format:check` | exit 0 |
  | `task frontend:test` | 657 tests pass, 50 files |
| `task frontend:build:{core,proprietary,saas,desktop,prototypes}` | all
green |
| `task desktop:build` | full Tauri pipeline →
`Stirling-PDF_2.11.0_x64_en-US.msi` |
  | `playwright test --list --project=stubbed` | 172 tests discovered |

`task desktop:build` exercises the heaviest path — Rust + WiX + MSI
bundle
against the moved `editor/src-tauri/`. If anything in the restructure
was
  wrong it wouldn't have built.

  ### Test plan

  - [ ] `frontend-validation.yml` green
  - [ ] `e2e-stubbed.yml` green
  - [ ] `tauri-build.yml` green on at least one platform
  - [ ] `check_toml.yml` runs on a translation-touching PR

---------

Co-authored-by: Claude Opus 4.7 (1M context) <[email protected]>

frontend/editor/vite.config.ts

@@ -0,0 +1,155 @@
+import { defineConfig, loadEnv, type PluginOption } from "vite";
+import react from "@vitejs/plugin-react-swc";
+import tsconfigPaths from "vite-tsconfig-paths";
+import { viteStaticCopy } from "vite-plugin-static-copy";
+
+const VALID_MODES = [
+  "core",
+  "proprietary",
+  "saas",
+  "desktop",
+  "prototypes",
+] as const;
+type BuildMode = (typeof VALID_MODES)[number];
+
+const TSCONFIG_MAP: Record<BuildMode, string> = {
+  core: "./tsconfig.core.vite.json",
+  proprietary: "./tsconfig.proprietary.vite.json",
+  saas: "./tsconfig.saas.vite.json",
+  desktop: "./tsconfig.desktop.vite.json",
+  prototypes: "./tsconfig.prototypes.vite.json",
+};
+
+export default defineConfig(async ({ mode }) => {
+  // Load env files relative to this config (frontend/editor/), regardless of
+  // where the build was invoked from. The previous `process.cwd()` worked when
+  // this file lived at frontend/, but after the editor was moved under
+  // frontend/editor/ the cwd-based lookup would miss editor/.env*.
+  const env = loadEnv(mode, import.meta.dirname, "");
+
+  // Effective mode: --mode > STIRLING_FLAVOR > ENABLE_SAAS > DISABLE_ADDITIONAL_FEATURES > proprietary.
+  const explicitMode = (VALID_MODES as readonly string[]).includes(mode)
+    ? (mode as BuildMode)
+    : null;
+  const flavor = (process.env.STIRLING_FLAVOR ?? "").toLowerCase();
+  const flavorMode: BuildMode | null =
+    flavor === "core" || flavor === "proprietary" || flavor === "saas"
+      ? (flavor as BuildMode)
+      : null;
+  const effectiveMode: BuildMode =
+    explicitMode ??
+    flavorMode ??
+    (process.env.ENABLE_SAAS === "true"
+      ? "saas"
+      : process.env.DISABLE_ADDITIONAL_FEATURES === "true"
+        ? "core"
+        : "proprietary");
+
+  const tsconfigProject = TSCONFIG_MAP[effectiveMode];
+
+  // Backend proxy target: default localhost:8080. Override via BACKEND_URL env var
+  // so the top-level dev launcher can wire a dynamically-assigned backend port.
+  const backendUrl = process.env.BACKEND_URL || "http://localhost:8080";
+  const backendProxy = {
+    target: backendUrl,
+    changeOrigin: true,
+    secure: false,
+    xfwd: true,
+  };
+
+  // Shared between `vite` (dev) and `vite preview` (production-build serve, used
+  // in CI/E2E) so the live test suite still resolves /api → :8080.
+  const backendProxyConfig =
+    effectiveMode === "desktop"
+      ? undefined
+      : {
+          "/api": backendProxy,
+          "/oauth2": backendProxy,
+          "/saml2": backendProxy,
+          "/login/oauth2": backendProxy,
+          "/login/saml2": backendProxy,
+          "/swagger-ui": backendProxy,
+          "/v1/api-docs": backendProxy,
+        };
+
+  return {
+    plugins: [
+      react(),
+      tsconfigPaths({
+        projects: [tsconfigProject],
+      }),
+      // Set ANALYZE=true to emit dist/stats.html (treemap) alongside the
+      // build; rollup-plugin-visualizer is ESM-only so we import dynamically.
+      ...(process.env.ANALYZE === "true"
+        ? [
+            (await import("rollup-plugin-visualizer")).visualizer({
+              filename: "dist/stats.html",
+              template: "treemap",
+              gzipSize: true,
+              brotliSize: true,
+              emitFile: false,
+            }) as PluginOption,
+          ]
+        : []),
+      viteStaticCopy({
+        targets: [
+          {
+            // node_modules is hoisted to the workspace root (frontend/), so
+            // these paths walk up one level from editor/.
+            src: "../node_modules/@embedpdf/pdfium/dist/pdfium.wasm",
+            dest: "pdfium",
+          },
+          {
+            // Copy jscanify vendor files to dist
+            src: "public/vendor/jscanify/*",
+            dest: "vendor/jscanify",
+          },
+          {
+            // pdfjs-dist CMap data for CJK / non-latin glyph mapping. Required
+            // when rendering PDFs inside workers where the default DOM fetch paths
+            // aren't available.
+            src: "../node_modules/pdfjs-dist/cmaps/*",
+            dest: "pdfjs/cmaps",
+          },
+          {
+            // pdfjs-dist standard font data (Helvetica/Times/etc.) needed so
+            // workers can substitute non-embedded base 14 fonts without DOM access.
+            src: "../node_modules/pdfjs-dist/standard_fonts/*",
+            dest: "pdfjs/standard_fonts",
+          },
+        ],
+      }),
+    ],
+    server: {
+      host: true,
+      // make sure this port matches the devUrl port in tauri.conf.json file
+      port: 5173,
+      // Tauri expects a fixed port, fail if that port is not available
+      strictPort: true,
+      watch: {
+        // tell vite to ignore watching `src-tauri`
+        ignored: ["**/src-tauri/**"],
+      },
+      // Only use proxy in web mode - Tauri handles backend connections directly
+      proxy: backendProxyConfig,
+    },
+    preview: {
+      host: true,
+      port: 5173,
+      strictPort: true,
+      proxy: backendProxyConfig,
+    },
+    // base: "./" produces relative asset URLs which work when dist/ is served
+    // at any path (e.g. Spring Boot bundling the frontend at /). But under
+    // `vite preview` for deep SPA routes (e.g. /workflow/sign/<token>), the
+    // browser resolves ./assets/X.js relative to the current path → 404, then
+    // SPA fallback returns index.html as text/html and React never mounts.
+    // VITE_BUILD_FOR_PREVIEW=1 (set by the CI playwright steps) overrides to
+    // an absolute base so deep-route asset paths resolve to /assets/...
+    base: env.RUN_SUBPATH
+      ? `/${env.RUN_SUBPATH}`
+      : process.env.VITE_BUILD_FOR_PREVIEW === "1"
+        ? "/"
+        : "./",
+  };
+});