spp_change_request_v2: CRReviewPanel is never mounted — wire it in or remove it

[gonzalesedwin1123]

Summary

spp_change_request_v2/static/src/components/review_panel/ (review_panel.js 276 lines, review_panel.xml 317 lines, review_panel.scss 50 lines; 643 lines total) defines CRReviewPanel, a split-pane change-request review component with approve / request-changes / decline actions and multi-tier approval display.

Nothing references it. CRReviewPanel and the spp_change_request_v2.CRReviewPanel template are not used by any XML view, JS registry (registry.category(...)), client action, field widget or Python file. It has been unmounted dead code since the initial export (4da8e30e, 2026-02-03); the three commits that touched it since were formatting and a hotkey removal.

Found while fixing #450: the panel still requested the removed rpc web service in setup(), and would have crashed the first time anyone mounted it. That PR removes only the unused useService("rpc") line and leaves the component in place, so this issue tracks the real decision.

Why it matters

• The component ships in web.assets_backend for every backend user (static/src/components/**/* in the manifest), so its JS, template and SCSS are downloaded and compiled for nothing.
• It duplicates approval actions (action_approve, _do_request_revision, _do_reject) that the form view already exposes, so any change to that flow has a second, untested copy to keep in sync. It calls two underscore-prefixed model methods (_do_request_revision, _do_reject) directly over RPC, which is not a pattern we want copied.
• Being never mounted, it has no test or tour coverage, so bugs like useService("rpc") no longer exists on Odoo 19 - latent crash in spp_change_request_v2 review panel and spp_dci_compliance security warning #450 accumulate silently.

Options

1. Remove it (manifest globs already pick up the directory, so deleting the three files is the whole change; bump + HISTORY entry). Recommended unless someone has a plan for it.
2. Wire it in as the review UI it was designed to be (client action or form-embedded widget), with a tour or e2e test that mounts it, and stop calling underscore-prefixed methods over RPC.

Refs

• useService("rpc") no longer exists on Odoo 19 - latent crash in spp_change_request_v2 review panel and spp_dci_compliance security warning #450 (rpc line removed, component left in place)
• spp_change_request_v2/__manifest__.py assets → spp_change_request_v2/static/src/components/**/*

[gonzalesedwin1123]

Additional findings from the PR #527 expert review that strengthen the "remove it" option. None of these can be caught by the new useService lint; the component has simply never run:

• review_panel.js lines 181 and 201 call _do_request_revision and _do_reject through orm.call. Odoo refuses remote calls to underscore-prefixed methods (odoo/orm/utils.py check_method_name raises AccessError('Private methods ... cannot be called remotely')), so "Request changes" and "Decline" would fail the first time anyone clicked them.
• line 110 reads res.partner.spp_id, a field defined nowhere in the repo, so loadRegistrantData would raise and the panel would always show "Error loading review data".
• line 137 reads current_tier and tier_review_ids on spp.approval.review; neither exists (spp_approval/models/approval_review.py has status only; multi-tier state lives on the mixin as current_tier_id / current_tier_name).
• this.action and this.dialog are assigned in setup() and never used, same as the this.rpc handle fix(dci_compliance): stop requesting the rpc service Odoo 19 removed; show warnings to administrators only (#450) #527 removed.

So wiring it in (option 2) is not "mount an existing component" but a rewrite of its data layer against the real models; option 1 (remove) stays the recommendation.