139ec1e6b8
Extract storage allowlist into internal/storageallowlist so KB creation uses FirstAllowed when tenant default_provider is empty or disallowed. Share pickUsableStorageProvider via editorResources for consistent UI selection, and add regression tests for OBS status and allow-list defaults.