fix(acl): Media access policy menu, file editor, and browser unpack

[Ibochkarev]

What changed and why

Partial fix for #14468. Three commits on this branch cover the items I called out in the issue comment, plus a second pass on the keys that were still wrong in code or lexicon.

Commit 1 — menu, editor Save, browser unpack

1. file_manager off the parent media row (upgrade 3.3.0-pl included).
2. File editor: open on file_view, Save on file_update + source save, read blocked without source view.
3. unpackFile on MODx.browser.View.

Commit 2 — eslint on the new JS handler.

Commit 3 — remaining Media ACL accuracy
4. Browser/File/Get checked source policy delete instead of view (copy-paste bug since 2013). Fixed to match Download/Unpack.
5. Tree and browser page links (click-to-edit) now require file_view and source view. Without it you keep Rename (file_update) but lose Edit / Quick Update menu entries and the node click shortcut.
6. English lexicon: directory_chmod describes Set Visibility, not chmod. file_create vs file_upload spelled out. Notes that Media Source policies are a second gate on file_view / file_update.

Left alone on purpose (matches the 2026 issue analysis): file_list / directory_list orthogonality, separate file_upload vs file_create keys, folder Refresh / copy-path without file keys, renaming directory_chmod permission key, Packages file_upload (#14436), Sources / Files tab (#14435, #14467), #16595 / menu_media.

How to test

Menu — policy with sources, without file_manager: Media shows, Sources works, Browser hidden. ?a=media/browser denied.

File editor — file_view on, file_update off: editor opens read-only, no Save. Both on + source save: Save works.

file_view on tree — without file_view: no click-to-edit on file nodes, no Edit / Quick Update in menu. With file_view only: click opens editor, no Save.

Browser/File/Get — user with source view but not delete can quick-read a file (was blocked before).

Unpack — zip context menu in Media Browser right panel, no console error.

Upgrade — parent media row has empty permissions after 3.3.0-pl.

PHPUnit

php -l core/src/Revolution/Processors/Browser/File/Get.php
cd _build/test && ../../core/vendor/bin/phpunit --testsuite Controllers --filter 'MediaAccessPolicy|SystemFileEdit'

7 tests, exit 0 (checked locally).

Also smoke-tested on revolution.test (admin): login, Media submenu, browser, zip Unzip menu, file editor Save.

Related issue(s)/PR(s)

Refs #14468

Related: #16595, #14435, #14436, #14467

Compatibility notes

Manager ACL/UI + en lexicon only. No CHANGELOG entry. Existing sites need upgrade script or manual menu fix.

Breaking change assessment

No API changes. Stricter UI: no tree click-to-edit without file_view. Browser/File/Get now honors source view instead of wrongly requiring delete.

Test coverage

• MediaAccessPolicyTest — transport menu, File/Get policy, tree page gate, lexicon strings
• SystemFileEditControllerTest — file editor permissions and browser unpack handler

Contributors

@Ruslan-Aleev opened the issue. Scope and re-check in #14468 comments.