chore(ui): hide Mesh, Fleet Secrets, and Host Console behind experimental discovery (#1624)

Gate Routing, Secrets, Host Console, and Mesh dashboard/settings surfaces on the existing useExperimental readiness flag so immature operator surfaces stay out of the default UI while paid and admin backend gates remain unchanged.

frontend/src/lib/routing/reachability.test.ts

@@ -2,6 +2,8 @@ import { describe, it, expect } from 'vitest';
 import {
   authzReady,
   isViewHidden,
+  isFleetTabHidden,
+  isSettingsSectionHidden,
   normalizeHiddenView,
   type ReachabilityContext,
 } from './reachability';
@@ -16,6 +18,8 @@ function ctx(over: Partial<ReachabilityContext> = {}): ReachabilityContext {
     containerLabelsEnabled: true,
     permissionsStatus: 'ready',
     licenseStatus: 'ready',
+    experimental: false,
+    experimentalReady: true,
     ...over,
   };
 }
@@ -46,7 +50,41 @@ describe('reachability', () => {
   });
 
   it('preserves paid views when license metadata failed', () => {
-    const licenseError = ctx({ licenseStatus: 'error' });
+    const licenseError = ctx({ licenseStatus: 'error', experimental: true });
     expect(isViewHidden('host-console', licenseError)).toBe(false);
   });
+
+  it('does not apply experimental hide to host-console until experimentalReady', () => {
+    const loading = ctx({ experimental: false, experimentalReady: false, isPaid: true, isAdmin: true });
+    expect(isViewHidden('host-console', loading)).toBe(false);
+  });
+
+  it('hides host-console when experimental is ready and off even for paid admin', () => {
+    const off = ctx({ experimental: false, experimentalReady: true, isPaid: true, isAdmin: true });
+    expect(isViewHidden('host-console', off)).toBe(true);
+    expect(normalizeHiddenView('host-console', off)).toBe('dashboard');
+  });
+
+  it('keeps host-console when experimental is on for paid admin', () => {
+    const on = ctx({ experimental: true, experimentalReady: true, isPaid: true, isAdmin: true });
+    expect(isViewHidden('host-console', on)).toBe(false);
+  });
+
+  it('hides routing and secrets fleet tabs only after experimentalReady when off', () => {
+    const loading = ctx({ experimental: false, experimentalReady: false });
+    expect(isFleetTabHidden('routing', loading)).toBe(false);
+    expect(isFleetTabHidden('secrets', loading)).toBe(false);
+
+    const off = ctx({ experimental: false, experimentalReady: true });
+    expect(isFleetTabHidden('routing', off)).toBe(true);
+    expect(isFleetTabHidden('secrets', off)).toBe(true);
+    expect(isFleetTabHidden('deployments', off)).toBe(false);
+    expect(isFleetTabHidden('federation', off)).toBe(false);
+    expect(isFleetTabHidden('actions', off)).toBe(false);
+  });
+
+  it('does not hide fleet-mesh settings for experimental off', () => {
+    const off = ctx({ experimental: false, experimentalReady: true, isAdmin: true });
+    expect(isSettingsSectionHidden('fleet-mesh', off)).toBe(false);
+  });
 });