fix(web): accept Apple's zero-total placeholder on Bundle ID App Group graphs - #2855

Fixes #2854.

Problem

asc web app-groups assign, unassign and set refuse every Bundle ID that has a capability:

cannot safely update Bundle ID "BUNDLE_ID": Bundle ID capability graph returned 2 of 0 resources

Apple returns two zero-total placeholders on the Bundle ID detail read (captured 2026-10-03):

• The selected bundleIdCapabilities relationship reports {"total":0,"limit":50}, echoing the requested limit[bundleIdCapabilities], beside complete linkage.
• After an assignment, the nested appGroups relationship of the APP_GROUPS capability reports {"total":0,"limit":2147483647}, the same unbounded placeholder already handled for Services IDs (serviceIDCapabilityPlaceholderLimit). With only the first fixed, the write is accepted but its verification read fails with APP_GROUPS appGroups relationship returned 1 of 0 resources.

Fix

validateDeveloperRelationshipCompleteness accepts a zero total only when it proves the relationship complete:

• With an include limit requested: the reported limit is that limit, and fewer resources came back than it allows.
• With no limit requested: the reported limit is the unbounded one.

A continuation link, a different or missing limit, a full page at the requested limit, or a real shortfall still fail closed before any write.

Tests

• TestAssignDeveloperAppGroupAcceptsZeroTotalCapabilityPlaceholder: an end-to-end assign using both captured shapes, before and after the PATCH. It was RED with the reported error, then the verification error, and is now GREEN.
• TestValidateDeveloperRelationshipCompletenessZeroTotalPlaceholder: a table of accepted placeholders and the cases that must stay rejected.

Verification

• Live: with this branch, assign succeeded on two real Bundle IDs. Re-running reports already-assigned for both, read back through the fixed verification path.
• Local checks: make format (no changes outside this diff), make lint (0 issues), make check-docs, make build, and ASC_BYPASS_KEYCHAIN=1 go test ./internal/web/ all pass.
• Not run: the repository's Codex /review gate.

ASC_BYPASS_KEYCHAIN=1 make test reports four failures that also fail on unmodified main on this host (Go 1.27.1, newer than the module's go 1.26.6):

• TestVerifyMachOAgreesWithCodesignOnSystemBinary and …OnLaunchConstrainedBinary: x509 rejects SHA1-RSA in Apple's chain.
• TestParseCapabilitySettingsRejectsInvalidStructure and TestBundleIDCapabilitiesSettingsValidationStopsBeforeHTTP: the expected encoding/json error text differs.

They're unrelated to this change.