[Improvement]: Rich references (hyperlinks + reference documents) in approval workflow steps

[mvkonchits-db]

Area: Approval workflows — wizard step rendering (src/frontend/src/components/workflows/approval-wizard-dialog.tsx) + step config models (src/backend/src/models/process_workflows.py)
Version: v1.0.0 (09b2b31)
Related: #570 (Team/Ownership polish); approval step catalog (#242)

Motivation

Approval steps frequently need to point the requester/approver at a document or resource — a data-usage policy, legal terms, an operational runbook, the underlying data product / contract / glossary concept, or an external SharePoint/Confluence page. Today there is no supported way to render a clickable reference in any approval step. This surfaced via the acknowledgement / legal-document steps, but it is a recurring, cross-step need — so it is worth solving generally rather than as a one-off "link in the acknowledgement step."

Current state (gaps)

1. Markdown renderer ignores links. simpleMarkdown() (approval-wizard-dialog.tsx:34-48) supports headings/bold/italic/lists only. A [text](url) in legal_document.body_markdown renders as literal text; raw <a> is HTML-escaped → no clickable link.
2. Step descriptions are plain text. Rendered as <p>{description}</p> (:903-904) — no markdown, no links.
3. Checklist item labels are plain text. acknowledgement_checklist items render as plain <Label>{item.label}</Label> (:1010) — a consent item can't link to the thing being consented to.
4. Dead document_url field. UserActionStepConfig.document_url ("URL of document to display, e.g. legal terms") and document_content exist in the backend model (process_workflows.py:227-228) but are never rendered in the frontend (no usage found).

Proposed (scalable) solution — solve once, reuse across all step types

A. Hyperlink support in rendered step content. Extend the wizard's markdown rendering (ideally a single shared markdown component) to support [text](url) → <a href target="_blank" rel="noopener noreferrer">, applied consistently to legal_document.body_markdown, every step description, and acknowledgement_checklist item labels.

B. First-class "Reference documents" on any step. Promote the dormant document_url/document_content into a reusable, repeatable config block usable by user_action, legal_document, and acknowledgement_checklist:

references: [ { label: string, url: string } ]   // 0..n

Rendered as a consistent "Reference documents" affordance (links / "View document" buttons) in the wizard, and optionally embedded in the generated agreement PDF for audit.

C. (Stretch) Internal deep-links. Allow a reference to target an Ontos entity (data product / contract / concept) by id, not just an external URL — so a consent step can link straight to the product/contract/glossary term it governs. Reuses the existing entity model and serves discovery, not just legal text.

Why this is scalable / serves other purposes

One mechanism then covers: data-usage & legal terms, a link to the governed product/contract, glossary concept definitions ("what does 'PII' mean here?"), operational runbooks, external policy pages, and audit-friendly references in the agreement PDF — instead of a single-purpose acknowledgement link.

Acceptance criteria

• Markdown links render and open safely (target=_blank, rel=noopener) in body, descriptions, and checklist labels.
• A step can declare 0..n reference documents (label + url) rendered consistently across step types.
• Existing document_url/document_content either feed the new references model or are deprecated in its favor (no silent dead field).
• (If C) a reference can resolve to an internal entity by id and deep-link to it.