Add signature rejection policy configuration UI

Add the Policy Workbench UI for the signature_rejection policy defined by #7832 and implemented in the backend by #8159.

Scope

Expose the signature rejection policy in the existing Policies & Rules interface.

Administrators must be able to configure:

• whether requesters are allowed to enable rejection for their signature requests;

• rejection comment mode:

  • disabled;
  • optional;
  • required;

• whether rejection cancels the remaining signing workflow;

• whether rejection status may be publicly visible;

• whether a non-private rejection comment may be shown on the validation page.

The enabled value means that the requester is allowed to offer rejection.

It must not be presented as automatically enabling rejection for all signature requests.

Comment privacy

Comment privacy is not an administrator policy option.

When comments are enabled, the signer can always choose to make their own rejection comment private.

The Policy Workbench must not add an option such as allow_private_comment.

Policy behavior

The UI must follow the existing Policies & Rules patterns for:

• system scope;
• group scope;
• user scope;
• inheritance;
• delegation;
• child overrides;
• non-editable inherited values.

The backend is the source of truth for policy validation.

Do not duplicate backend validation rules in the frontend.

When a parent policy requires rejection comments, a delegated child rule must not allow the administrator to weaken this requirement.

The UI should use the policy metadata and validation behavior already provided by the Policies & Rules backend instead of creating rejection-specific permission logic.

Tests

Add or update frontend tests covering at least:

• rendering the rejection policy;
• loading existing values;
• saving changed values;
• enabled and disabled states;
• disabled comment mode;
• optional comment mode;
• required comment mode;
• cancel_workflow;
• public_status;
• show_comment_on_validation;
• dependent options;
• system scope;
• group scope;
• user scope;
• inherited values;
• non-editable values;
• delegated policy behavior;
• a delegated rule not being able to weaken a required rejection comment.

Follow the existing Policy Workbench frontend test patterns.

Quality gates

The implementation must pass the existing frontend checks, including:

• ESLint;
• type checking;
• frontend tests.

Out of scope

This issue does not implement:

• backend rejection behavior;
• requester configuration in the request-signature flow;
• signer rejection UI;
• validation page rendering.

These are handled by #8159, #8161, and #8162.

Start by locating the existing Policies & Rules interface and its frontend test patterns, then review the policy metadata and validation behavior provided by the backend. Add the signature_rejection settings across system, group, and user scopes while preserving inheritance, delegation, dependent options, and non-editable values. Done means the listed rendering, loading, saving, and behavior tests pass alongside ESLint, type checking, and frontend tests.