Show Duo availability namespaces table only to admins

What does this MR do and why?

The "Group Duo availability" table (<duo-availability-namespaces />) appears on a group's Settings > GitLab Duo page and shows "An error occurred while loading the group list." The table is an instance-admin feature, so only instance admins should see it.

ai_common_settings_form.vue used to gate the component with a v-if on the adminDuoAvailabilityNamespaceOverrides feature flag, which only the admin controller pushed. Removing the flag also removed the v-if, so the table rendered on every page that shares the form, including group settings.

The adminDuoAvailabilityNamespaces GraphQL query is authorized against the global :read_namespace_duo_availability permission, which only instance admins have. Group Owners therefore get the error.

This MR shows the table only when the current user has read_namespace_duo_availability. The global policy grants that permission only to instance admins (on GitLab.com, only with admin mode on), and it is the same permission the table's query checks.

Backend:

• Admin::AiConfigurationPresenter#settings passes can_read_namespace_duo_availability.
• EE::Groups::SettingsHelper#duo_feature_settings_data passes it too. That helper feeds both group Settings > GitLab Duo > Configuration and group Settings > General.

Frontend:

• ee/app/assets/javascripts/ai/settings/index.js parses the value.
• ai_common_settings_form.vue renders <duo-availability-namespaces /> with v-if="canReadNamespaceDuoAvailability".

Admins see the table on the admin page and on group settings pages, on SaaS and self-managed. Non-admins, including group Owners, never see it.

The Jest spec covers the permission being true and false. The presenter spec and the group settings helper spec cover the new key for an admin and a non-admin.

How to reproduce the issue

1. Set up a GDK with an Ultimate license in SaaS mode: add export GITLAB_SIMULATE_SAAS=1 to env.runit at the GDK root, then run gdk restart rails-web. You also need a top-level Ultimate group and a non-admin user who is an Owner of that group.
2. Check out master.
3. Sign in as that user and go to http://gdk.test:3000/groups/<group-path>/-/settings/gitlab_duo/configuration (the group's Settings > GitLab Duo > Configuration).
4. A "Group Duo availability" section renders with "An error occurred while loading the group list."

How to test the fix

1. Check out 631488-hide-duo-availability-namespaces-on-group-settings.
2. Repeat step 3 above as the group Owner. There is no "Group Duo availability" section and no error. The rest of the form still renders.
3. Sign in as an instance admin (enable admin mode if prompted) and open the same page. The table renders and loads groups.
4. To check self-managed, remove GITLAB_SIMULATE_SAAS from env.runit and restart Rails. As an admin, open Admin > GitLab Duo > Configuration. The table still renders.
5. Run the specs:
   • yarn jest ee/spec/frontend/ai/settings/components/ai_common_settings_form_spec.js
   • bin/rspec ee/spec/presenters/admin/ai_configuration_presenter_spec.rb ee/spec/helpers/ee/groups/settings_helper_spec.rb

References

• #631488 (closed)

Screenshots or screen recordings

Instance admin	Non-admin group Owner

Both screenshots show the group's Settings > GitLab Duo > Configuration page in SaaS mode. The instance admin sees the "Group Duo availability" table. The non-admin group Owner does not.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.