feat: add rejected approval status (AAI-526)

[uwwint]

Description

AAI-526: add rejection status

Changes

• Add rejection status
• Align state transitions
• link group roles between groups in DB and Auth0 based on naming convention

Checklist

• I have commented my code, particularly in hard-to-understand areas
• I have added unit / integration tests that prove my fix is effective or that my feature works
• I have run all tests locally and they pass
• I have updated the documentation (if applicable)
• For any new secrets, I have updated the shared spreadsheet and the GitHub Secrets.

How to Test Manually (if necessary)

register a user for a bundle
log in as bundle admin
find the user click reject, record a reason

[Copilot]

Pull request overview

This PR adds rejection functionality for group membership requests, aligns state transitions to be more explicit, and implements automatic linking of Auth0 admin roles to platforms and groups based on naming conventions.

Key Changes

• Introduced a new REJECTED status to ApprovalStatusEnum with a rejection_reason field for group memberships
• Implemented state transition validation that prevents invalid state changes (e.g., approving already-approved memberships now returns 400 instead of 200)
• Added link_admin_roles() function to automatically associate admin roles with platforms/groups based on the pattern biocommons/role/{id}/admin

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
migrations/versions/c4c7a8e9b2d3_group_membership_rejection.py	Adds database migration for the REJECTED enum value and rejection_reason column
db/types.py	Adds REJECTED status to ApprovalStatusEnum and rejection_reason to GroupMembershipData
db/models.py	Implements reject() method, updates save_history() to handle rejection reasons, adds Auth0Role.get_all()
routers/admin.py	Adds reject endpoint for group memberships, adds state validation to approval endpoints
routers/biocommons_groups.py	Allows users to re-request group access after rejection, validates state transitions in approval
scheduled_tasks/tasks.py	Implements link_admin_roles() to automatically associate admin roles with platforms/groups
tests/test_admin.py	Adds comprehensive tests for rejection workflow and state transition validation
tests/biocommons/test_api.py	Tests re-requesting after rejection and preventing approval of rejected memberships
tests/db/test_models.py	Updates existing test to ensure approval status is set correctly
tests/scheduled_tasks/test_tasks.py	Tests link_admin_roles() functionality including case-insensitive matching

[marius-mather]

Looks good but I don't know if we need a separate _reason field for each type of change, seems cleaner to just have an all-purpose reason field.

[marius-mather]

good to go