Add config to disable the Fully Enable button

[jnunemaker]

Summary

• Adds disable_fully_enable config option to Flipper::UI that prevents full-enabling features from the web UI
• Single option accepts true (default message), a string (custom message), or nil/false (enabled, the default)
• Server-side 403 enforcement when bypassing the disabled button (curl, devtools, etc.)
• Based on Add config to disable the Fully Enable button #973 with review feedback applied: renamed from fully_enable_disabled/fully_enable_disabled_with, collapsed to single config option, 403 template uses configured message

Usage

# Disable with default message
Flipper::UI.configure do |config|
  config.disable_fully_enable = true
end

# Disable with custom message
Flipper::UI.configure do |config|
  config.disable_fully_enable = "Use deploy pipeline instead."
end

Note: This only affects the UI. If flipper-api is mounted, full enable is still possible via the API.

Test plan

• Config defaults to nil, accepts true, false, and string values
• disable_fully_enable_message returns default message for true, custom string when set
• Server returns 403 with configured message when fully enable is disabled
• Disable action still works when fully enable is disabled
• Explicit false does not block enabling
• Button renders as disabled with tooltip in the UI
• Custom message shown in both tooltip and 403 response
• Full RSpec suite passes (2813 examples, 0 failures)

Closes #973

🤖 Generated with Claude Code