feat: Worker portal Stage 6 — Studio onboarding wizard

Description

Land the Jurisdiction Studio onboarding wizard: a 5-step guided flow for a new jurisdiction to bootstrap its rulesets/{jurisdiction}/ directory (composition TOMLs, idp.toml, theme.toml, citations stub). Output is a real PR against the canopy repo introducing the new jurisdiction.

This is the entry point to the Studio maintainer surface.

Acceptance Criteria

  • Template at services/canopy-web/templates/studio/onboarding.html
  • 5-step wizard (step state persisted in tower-sessions session):
    1. Jurisdiction metadata (slug, name, timezone, federal state code)
    2. IDP setup (add first IDP via idp.toml schema; or pick local-accounts only)
    3. Theme (pick from preset palettes or import a theme.toml)
    4. Program enablement (which of SNAP/TANF/Medicaid/CAPS/WIC are scoped in)
    5. Review + generate PR
  • Step 5 generates a PR via the Stage-3 promote-PR component, but against the canopy repo (not the jurisdiction baseline) — introducing rulesets/{new-slug}/ with the wizard's outputs
  • Gated to a studio_admin role (per Stage 2 composability ADR's role definitions)
  • Playwright E2E: end-to-end wizard against a sandbox git repo
  • axe-core WCAG 2.1 AA clean
  • CHANGELOG entry under === Added

Blocked by

  • Stage 3 promote-PR issue merged
  • Stage 4 IDP loader issue merged (for step 2's IDP schema)

Open questions (route to design)

  • Step 4 (program enablement): design package showed program toggles but didn't specify what happens to disabled programs at runtime. Confirm with design — does a disabled program just hide its UI, or does the jurisdiction skip the program service entirely (Docker Compose profile per ADR-005)?

Context & References

  • Tracking issue: #460
  • Epic: &51
  • Plan: worker-portal-redesign.adoc, Stage 6
  • Design canvas: Jurisdiction Studio onboarding from 2026-05-14 package
  • Related: ADR-005 (modular deployment profiles)

Labels

type::feature, priority::medium, program::infrastructure, service::web, workflow::needs-spec, compliance::wcag-21-aa