feat: agent catalog foundations and migration (#14316)

* feat(catalog): add policy data model

* fix(catalog): harden foundation migration

* feat(catalog): add policy service and admin API (#14318)

* feat(catalog): add policy service and admin API

* feat(catalog): expose governance config flag (#14319)

* feat(catalog): expose governance config flag

* feat(catalog): filter component palette by policy (#14320)

* feat(catalog): filter component palette by policy

* feat(catalog): filter starter templates by policy (#14321)

* feat(catalog): filter starter templates by policy

* feat(catalog): enforce component policy at runtime (#14322)

* feat(catalog): close remaining enforcement paths (#14364)

* fix(catalog): sequence migration after provider policy

* fix(catalog): remove stale authorization test mock

Author: erichare

docs/docs/Deployment/deployment-block-custom-components.mdx

@@ -31,6 +31,23 @@ LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY=true
 
 When set to `true`, non-superusers can still view and use custom components in flows, but they cannot create new custom components or edit custom component code.
 
+## Interaction with catalog governance
+
+Catalog governance takes precedence over the custom-code settings on the custom-component create, update, and code-validation endpoints. A catalog block has no superuser bypass.
+
+| Submitted source | Catalog policy | Custom components | Admin-only mode | Result |
+|---|---|---|---|---|
+| Known server template | Blocked | Either | Either | Denied for every user |
+| Known server template | Allowed | Disabled | Either | Allowed using the trusted server source |
+| Known server template | Allowed | Enabled | Non-superuser | Allowed using the trusted server source |
+| Unknown custom source | Not blocked | Disabled | Either | Denied |
+| Unknown custom source | Not blocked | Enabled | Non-superuser | Denied |
+| Unknown custom source | Not blocked | Enabled | Superuser or admin-only disabled | Allowed |
+
+For `POST /api/v1/validate/code`, this policy runs before the source is parsed or imports are inspected. In a restricted custom-code mode, known templates are validated from the trusted server copy, while unknown source follows the same disabled or admin-only rule as the component editor. On custom-component create and update, known blocked template source is rejected before the component is built, and the resolved component type is checked again before request-supplied frontend updates are applied.
+
+An active catalog policy fails closed with a temporary `503` response while server template identities are still initializing. An empty catalog policy preserves the default behavior and does not require template identity lookups.
+
 ## Configure a custom component allow-list
 
 `LANGFLOW_ALLOW_CUSTOM_COMPONENTS` works together with optional paths that define which component templates the server loads, and which code hashes are trusted.
@@ -62,4 +79,4 @@ Default is `true`, which preserves existing behavior. The setting has no effect
 For more information, see:
 
 * [Environment variables](/environment-variables#visual-editor-and-playground-behavior)
-* [Security](/security)
+* [Security](/security)