feat(gitlab): add configuration persistence and resource browsing

[asaphko]

Add GitLabConfiguration model with CRUD viewset and resource browsing endpoints. Second PR in the stacked series splitting #7028, building on #7120 (client).

Changes

• GitLabConfiguration model with soft-delete, lifecycle hooks for tag creation and external resource cleanup
• CRUD viewset with separate create/read serialisers (access_token is write-only)
• Resource browsing endpoints: projects, issues, merge requests, project members
• DRF-based query param validation (replaced DataclassSerializer with proper serialisers)
• Multi-repo support by design — no unique constraint on project FK
• ResourceType.GITLAB_ISSUE / GITLAB_MR, TagType.GITLAB, VCSProvider.GITLAB
• Conftest fixture, 40 tests (20 unique, parameterised across auth types)

Contributes to #7028
Stacks on #7120

Review effort: 3/5

Review feedback addressed from #7028

• access_token write-only on create serialiser (khvn26: security fix)
• Removed no-op extra_kwargs and dead destroy override (khvn26, emyller)
• Multi-repo support — removed UniqueConstraint on project (emyller: "ties a Flagsmith project to a single repository")
• Replaced DataclassSerializer with proper DRF serialisers (khvn26: "validation logic should live in the serialiser")
• Fixed permission class naming HasPermissionToGitLabConfiguration (emyller)
• Error handler includes actual error message in response (khvn26: "swallows it")
• Removed cleanup issue endpoint (emyller: "way too experimental")
• Fixed exception message (emyller: "text seems odd")
• Batched tag creation with bulk_create (emyller: "batch these")
• Proper type annotations — mypy strict clean, minimal type: ignore
• Top-level imports where possible, local imports only for circular dependency avoidance
• British English (COLOUR)

🤖 Generated with Claude Code

[claude]

⚠️ Code review skipped — your organization's overage spend limit has been reached.

Code review is billed via overage credits. To resume reviews, an organization admin can raise the monthly limit at claude.ai/admin-settings/claude-code.

Once credits are available, reopen this pull request to trigger a review.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

3 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
docs	Ignored	Preview	Apr 3, 2026 1:22pm
flagsmith-frontend-preview	Ignored	Preview	Apr 3, 2026 1:22pm
flagsmith-frontend-staging	Ignored	Preview	Apr 3, 2026 1:22pm

[github-actions]

Docker builds report

Image	Build Status	Security report
ghcr.io/flagsmith/flagsmith-e2e:pr-7121	Finished ✅	Skipped
ghcr.io/flagsmith/flagsmith-api-test:pr-7121	Finished ✅	Skipped
ghcr.io/flagsmith/flagsmith-api:pr-7121	Finished ✅	Results ✅
ghcr.io/flagsmith/flagsmith:pr-7121	Finished ✅	Results ✅
ghcr.io/flagsmith/flagsmith-frontend:pr-7121	Finished ✅	Results ✅

[codecov]

Codecov Report

❌ Patch coverage is 98.86686% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 98.26%. Comparing base (11bf93f) to head (cb3a6ef).
⚠️ Report is 1 commits behind head on feature/gitlab-client.

Files with missing lines	Patch %	Lines
api/integrations/gitlab/views.py	96.46%	4 Missing ⚠️

Additional details and impacted files

@@                    Coverage Diff                    @@
##           feature/gitlab-client    #7121      +/-   ##
=========================================================
- Coverage                  98.26%   98.26%   -0.01%     
=========================================================
  Files                       1342     1353      +11     
  Lines                      50200    50437     +237     
=========================================================
+ Hits                       49330    49561     +231     
- Misses                       870      876       +6     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

Playwright Test Results (oss - depot-ubuntu-latest-16)

 10 passed

Details

 10 tests across 7 suites
 24 seconds
 cb3a6ef
 🔄 Run: #15693 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

 10 passed

Details

 10 tests across 7 suites
 49 seconds
 a791102
 🔄 Run: #15692 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

 10 passed

Details

 10 tests across 7 suites
 55.1 seconds
 cb3a6ef
 🔄 Run: #15693 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

 1 passed

Details

 1 test across 1 suite
 43.9 seconds
 a791102
 🔄 Run: #15692 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

 1 passed

Details

 1 test across 1 suite
 1 minute, 8 seconds
 a791102
 🔄 Run: #15692 (attempt 1)