Export as its own permission; explain empty team grouping in statistics

[luflow]

Summary

Two commits, from a report by Jörg: a sports officer with "May see everyone's statistics" could not export the participant lists, and grouping statistics by Teams seemed to do nothing.

Export is a permission of its own (export)

• POST /api/export and GET /api/export/series check canExport() instead of canManageAppointments(). Guests are blocked.
• Version000027 seeds the permission from manage_appointments (mode and groups, "all" included), so no install changes its effective access on update. Managers do not hold it implicitly.
• Shown in the admin settings and the setup wizard; web nav and card action gate on canExport; German added for all four l10n files.
• getPermissions gains canExport (additive). The Flutter client has no export and parses permissions defensively, so no capability flag.

Statistics: grouping by Teams

• The team axis only sections by the teams selected under "Response summary teams". With none selected (the default) everyone lands in Others while the select still offers "Teams", so it looked broken. The page now says why.
• Not a confirmed root cause for Jörg's instance: if teams are selected there and everyone still lands in Others, the suspect is VisibilityService::getTeamMembers() reading only direct Circles members (getMembers()), not members via groups or nested teams. Unverified, and it would also affect team visibility of appointments.

Testing

• PHPUnit: 686 tests pass, including new ones for the permission, the controller gate, the migration and the team axis of StatisticsService.
• eslint, stylelint, php-cs-fixer, vite build, both l10n checks and the OpenAPI check pass.
• psalm did not run: the sandbox has PHP 8.3.6, psalm refuses anything below 8.3.16.
• e2e did not run (no Docker): 42-export-permission.spec.js and 43-statistics-teams.spec.js are new and unrun. The Circles OCS calls in fixtures/nextcloud.js (create team, add member) were written from memory; the real-team test skips itself when the Teams app is off. Please run ./scripts/check.sh --e2e locally.

For a human to decide

• psalm-baseline.xml gets two hand-written entries for the new migration (UnusedClass, and DeprecatedMethod: setAppValue), like Version000021 has. The typed setter would avoid the deprecation but collides with IConfig::setAppValue on the next save (see the V21 note), so I kept IConfig.
• Export holders get every appointment and, optionally, every comment, independent of "May see comments" or the appointment's visibility. That is what managers can do today, now grantable to non-managers.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Kpc7muDbWFZzdBdzZKrkNN

---

Generated by Claude Code