feat: add SHOW ACCESS ON NANOFLOW and DESCRIBE MERMAID for nanoflows

[retran]

Summary

• Add SHOW ACCESS ON NANOFLOW Module.Name — displays allowed module roles table (mirrors microflow pattern)
• Add DESCRIBE MERMAID NANOFLOW Module.Name — renders nanoflow as Mermaid flowchart
• Refactor renderMicroflowMermaid → renderFlowMermaid accepting *MicroflowObjectCollection to share rendering between microflows and nanoflows

Why

Completes the nanoflow feature surface for the CLI. Without SHOW ACCESS, users cannot inspect nanoflow security grants. Without DESCRIBE MERMAID, nanoflow visualization is unavailable — both are already supported for microflows and pages.

Changes

• Grammar: Added SHOW ACCESS ON NANOFLOW qualifiedName rule
• AST: Added ShowAccessOnNanoflow enum constant
• Visitor: Added NANOFLOW branch in ACCESS dispatch
• Executor: Added listAccessOnNanoflow (cmd_security.go), nanoflowToMermaid + shared renderFlowMermaid (cmd_mermaid.go)
• Test: Updated unsupported-type test to use "workflow" instead of "nanoflow"

9 files changed. make build && make test && make lint-go pass.

[Copilot]

Pull request overview

This PR expands the CLI’s nanoflow feature set to match existing microflow/page capabilities by adding nanoflow security inspection and Mermaid visualization, and refactors Mermaid rendering to share flowchart generation logic.

Changes:

• Added grammar + AST + visitor + executor support for SHOW ACCESS ON NANOFLOW Module.Name.
• Added DESCRIBE MERMAID NANOFLOW Module.Name with a new nanoflowToMermaid executor path.
• Refactored microflow Mermaid rendering into a shared renderFlowMermaid that operates on an object collection.

Reviewed changes

Copilot reviewed 7 out of 9 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
mdl/grammar/MDLParser.g4	Adds SHOW/LIST ACCESS ON NANOFLOW qualifiedName grammar rule.
mdl/visitor/visitor_query.go	Adds NANOFLOW dispatch for SHOW ACCESS statement building.
mdl/ast/ast_query.go	Adds ShowAccessOnNanoflow enum + string name.
mdl/executor/executor_query.go	Routes new show object type to listAccessOnNanoflow.
mdl/executor/cmd_security.go	Implements listAccessOnNanoflow (mirrors microflow/page access listing).
mdl/executor/cmd_mermaid.go	Adds nanoflow Mermaid support and refactors to shared flow renderer.
mdl/executor/cmd_mermaid_mock_test.go	Updates unsupported-type test now that nanoflow Mermaid is supported.

Comments suppressed due to low confidence (1)

mdl/executor/cmd_mermaid.go:289

• renderFlowMermaid builds an activityMap but then immediately assigns it to '_' and never reads it. This is dead code and adds unnecessary work; either remove the map entirely or use it where intended (e.g., for lookups in label/detail generation).

	activityMap := make(map[model.ID]microflows.MicroflowObject)
	var startID model.ID

	for _, obj := range allObjects {
		activityMap[obj.GetID()] = obj
		if _, ok := obj.(*microflows.StartEvent); ok {
			startID = obj.GetID()
		}
	}
	_ = activityMap // used for reference

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

listAccessOnNanoflow introduces a new SHOW ACCESS code path but there is no corresponding mock test (cmd_security_mock_test.go covers microflow/page/workflow). Please add tests for JSON + text output and the not-found case to prevent regressions.

[Copilot]

In this new NANOFLOW branch, the inline comment above the ACCESS handler still says it only supports MICROFLOW|PAGE. Please update that comment to include NANOFLOW (and any other supported types) so it matches the actual dispatch logic.

[Copilot]

nanoflowToMermaid duplicates the entity name lookup logic used in microflowToMermaid. Consider extracting a shared helper (e.g., buildEntityNames(ctx,h)) to avoid divergence and keep behavior consistent across flow types.

[Copilot]

This new nanoflow Mermaid support is not covered by tests in cmd_mermaid_mock_test.go (there are already mock tests for domainmodel/microflow). Please add a mock test for describeMermaid("nanoflow", "Module.Name") similar to the microflow test to validate the new code path.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 11 changed files in this pull request and generated 1 comment.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

ctx.Backend.ListDomainModels() errors are being ignored here, which can hide backend failures and lead to incomplete entity name resolution in the rendered diagram. Handle the error and return a backend error (consistent with other backend calls in this function).

[retran]

Superseded by #10 (consolidated nanoflow PR)