Draft: List the groups of the Orbit token on the Orbit dashboard

What does this MR do and why?

The Overview and the Group status tab on Your work > Orbit now list the groups that Orbit answers for. On GitLab.com, the In your graph card said "Counts are not available right now", and Group status showed groups with "Status not available".

• A new orbitGroups query lists the groups of the Orbit token. A member of a subgroup only gets that subgroup, not its top-level group. Groups that the user reaches only through a project are not listed.
• The card loads the counts of each group and updates as each one arrives. One failed group no longer hides the counts of the others.
• On GitLab Self-Managed and GitLab Dedicated, admins still see every top-level group. On GitLab.com, admins see their own groups.

Follow-up to !261557 (merged), which fixed project members and Guests but left the subgroup case open.

References

• Orbit refuses a path that is not under a path of its token (authorize_traversal_path in the Orbit server). The token holds the highest Reporter group of each group tree.

Screenshots or screen recordings

On GitLab.com canary, with 2 of 10 groups that Orbit refuses:

Local GDK with a local Orbit. The user has the same memberships as on GitLab.com: Developer in two top-level groups, Developer in a subgroup only through a group share, a project share only in another top-level group, and Reporter in a group with Orbit off.

Page	Before (master)	After
Overview
Group status

Evidence of the bug

On GitLab.com, graph_status returned 404 {"code":7,"message":"Knowledge graph request failed"} for 2 of the 10 listed groups, and their index status was null. For the one I checked, the user is a member of a subgroup only, through a group share, and the same call on that subgroup returned 200 with counts.

On GDK, with the user from the screenshots:

Group	Membership	Listed before	Listed after	graph_status
e2e-jg-gitlab-com, e2e-jg-gitlab-org	Developer	Yes	Yes	200
e2e-jg-demo-fpotter	Developer in the subgroup autodevops-poc only, through a group share	Yes	No	404
e2e-jg-demo-fpotter/autodevops-poc	same	No	Yes	200
e2e-jg-allthethings	a project share only	Group status only	No	404
e2e-jg-off-root	Reporter, Orbit off	Group status only	Group status only	none

Which groups are listed

User has	Overview and the On filter	The All filter
Reporter or higher in a top-level group, also through a group share	The top-level group	The top-level group
Reporter or higher in a subgroup only	The subgroup	The subgroup
A project membership or a project share only	No	No
Reporter or higher in a group with Orbit off	No	The group, as Off
Admin on GitLab Self-Managed or GitLab Dedicated	Every top-level group with Orbit on	Every top-level group

• The list follows the 500-path limit of the token, so every listed group gets an answer from Orbit.
• A subgroup row shows the Orbit state of its top-level group.
• The counts cover the groups that the dashboard loads (50). A follow-up in Orbit will count every token path in one call.

How to set up and validate locally

1. In GDK, sign in as a user who is Reporter in a subgroup only of a top-level group with Orbit on, and a member of a project only in a second top-level group with Orbit on.
2. Go to http://127.0.0.1:3000/dashboard/orbit. On master, the In your graph card says "Counts are not available right now". On this branch, the card shows the counts, and the subgroup is listed.
3. Open the Group status tab. On this branch, the subgroup is listed and the second top-level group is not.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.