CF bulk operations: host pages for isolation segments, private domains, and plan visibility

Summary

Three CF bulk operations are implemented end to end (backend endpoint +
frontend service + a multi-select dialog + unit guards) but their dialogs are
not yet mounted anywhere, because the corresponding CF entities have no
management list/detail page in the console to attach an entry point to:

• Isolation segment → entitle N organizations — entitleOrgsToIsoSegment
  • EntitleIsoSegmentOrgsDialogComponent. No isolation-segment list/detail
    page exists.
• Private domain → share with N organizations — shareDomainWithOrgs +
  ShareDomainOrgsDialogComponent. Domains are only consumed today as the Add
  Route dropdown; there is no domain management surface.
• Service plan visibility → apply to N organizations —
  applyPlanVisibility + ServicePlanVisibilityEditorComponent. The plan
  visibility UI is read-only today; the editor is a ready building block with
  no host.

The backend endpoints and the dialogs are covered by tests and ship in the
bulk-operations work; this issue tracks giving them a reachable home.

What's needed

For each, a host surface that opens the existing dialog/editor with the
required context:

• Isolation segments: a list (and/or detail) page under the CF endpoint, with
  a per-row or detail "Entitle organizations" action opening the dialog with
  { cfGuid, isoGuid, isoName }.
• Private domains: a domain management surface (list/detail) with a "Share to
  organizations" action opening the dialog with { cfGuid, domainGuid, domainName }.
• Service plan visibility: mount ServicePlanVisibilityEditorComponent on the
  offering/plan detail surface, supplying the candidate org list; wire its
  applied output to refresh.

Notes

The dialogs/editor already carry unit guards asserting their wiring, so the
"unhosted" state is the only gap. No backend work is required.

Start by reading the existing EntitleIsoSegmentOrgsDialogComponent, ShareDomainOrgsDialogComponent, and ServicePlanVisibilityEditorComponent, along with their unit guards, then inspect the CF endpoint's current management surfaces. Done means each existing dialog or editor is mounted on a reachable isolation-segment, private-domain, or offering/plan surface with the stated context and refresh wiring.