spp_starter_sp_mis: make registry_admin_only_crud opt-out per action, not a global New-button hide

[gonzalesedwin1123]

Problem

When the config setting spp_starter.registry_admin_only_crud is enabled (default True), spp_starter_sp_mis/static/src/js/registry_restriction.js hides create/edit for non-admin users — the New button, canCreate/canEdit, and the delete/archive/duplicate action-menu entries — on every res.partner list and form. There is no supported way to allow non-admin CRUD on one specific action while keeping the restriction enforced everywhere else.

Downstream implementations sometimes need exactly that: one dedicated res.partner action where a non-admin role (e.g. field operators) can author records, while all other partner views stay restricted. Today the only way is to counter-patch ListController/FormController from a downstream module, which is fragile and depends on Odoo web internals.

Proposed fix

Honour a context flag set on the action:

<field name="context">{'bypass_registry_admin_only_crud': True}</field>

When present, registry_restriction.js skips the restriction for that action's views (the flag follows Odoo's normal context propagation, so relational dialogs opened from the exempt view inherit it — which the authoring use case needs). This flag name is already in use by downstream workarounds, so adopting it lets them delete their JS patches directly.

Affected

• spp_starter_sp_mis/static/src/js/registry_restriction.js
• Branch 19.0

Follow-up (out of scope here)

Longer term the restriction could be scoped server-side (registrant-flagged partners, exempt security group, get_view-level presentation) instead of per-model JS; tracked separately.

[gonzalesedwin1123]

Status (2026-07-10): implemented in #299 — CI green, awaiting review. The PR will close this issue on merge.

What shipped, beyond the original proposal:

• Module version bumped to 19.0.2.1.0 with a changelog fragment.
• Scope semantics: the flag follows Odoo's standard context propagation — the exempt action's list/form plus relational dialogs (many2one create/edit and search-more, x2many record dialogs) and actions opened via buttons from inside the exempt view inherit it. This is required for authoring flows and is documented in the docstring and DESCRIPTION.md so implementers scope bypass actions deliberately.
• Beacon-save opt-out: exempt form views also disable useSendBeaconToSaveUrgently. Authoring actions typically carry default_* context keys that make a new record dirty before the user types; without this, the blur-triggered urgent save raises validation errors on every tab refocus.
• Like the restriction itself, the flag is a client-side UI affordance, not a security boundary — server-side ACLs and record rules remain the real enforcement (documented in the file).

Verification: Python suite green; manual UI verification with headless Chrome against a live stack (restriction intact on plain partner actions for a non-admin Registry Officer, New button + editable create form on the bypass action, admin unaffected). An expert-review pass (code review, Odoo 19 web-internals deep-dive against framework source, security review) found no critical issues; its amendments are in the PR.

[Tarekchehahde]

Opened PR: #302

Local test summary: JS-only change; manual QA requires OpenSPP web UI with restriction enabled.