Validate Paragon icons on authz schemas #520

Description

Authorization schemas validate Paragon icon names against a vendored allow-list (paragon_icons.py), generated from the Paragon version used by frontend-app-admin-console (ADR 0017 §4, ADR 0026). Some follow-up work remains:

• CI check: run make paragon_icons_check in CI so a stale list is caught automatically.
• JSON Schema integration: once docs: add authorization schema reference #431 lands, move the icon rule into the shared field reference instead of keeping it as a separate Python check (see Extend schema loader validation to use schema reference defined in #431 #459).
• Sync process: define how the list gets refreshed when the admin console bumps its Paragon version, since that is currently a manual two-repo change.

Acceptance criteria

• CI runs make paragon_icons_check and fails if the list is stale.
• The icon rule lives in the shared field reference, with the same error messages.
• The process for refreshing the list is documented (ADR 0026 updated).