feat: Add customization URL parameter (#5992)

* Add customization URL parameter

* fix: Preserve should be customizeable

* Update customizations docs

* fix: Overlay items on patient name

* Add customization test

* Fix resolve to absolute path

* fix: Warn on no data in load

* Remove unused customization stuff

* fix: PR comments

* Update stored parameters to only use an array for mulitples

* Remove requires ohif.* special call out

* Remove strict mode

* PR comments

* Document segmentation examples

* Add three examples as requested

* PR comments

* lock

* Remove old customizatoin export

* fix: Ordering issues on customization loads

* fix: Use correct default for dev builds app config

* Fixes for conflicts

* chore: restore pnpm-lock.yaml to match master

The lockfile diff was incidental peer-descriptor churn and carried no
functional dependency change. It tripped the CircleCI security-audit gate
(which only runs when pnpm-lock.yaml is in the PR diff), surfacing a
pre-existing critical `decompress` transitive vuln that also exists on
master. Restoring master's lockfile removes the audit trigger.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(ci): restore json5 lockfile entry; ignore unfixable decompress GHSA

The previous commit restored pnpm-lock.yaml from master, which dropped the
json5@2.2.3 entry that platform/core legitimately depends on (JSONC parsing
for the customization feature). That broke `--frozen-lockfile` install
(ERR_PNPM_OUTDATED_LOCKFILE). This restores the correct lockfile.

Because the lockfile must change (json5), the CircleCI security-audit gate
runs and previously failed on a critical `decompress` <=4.2.1 zip-slip
advisory. This is a pre-existing transitive vuln (present on master too) with
no published patch — decompress's latest release is 4.2.1, so no version
bump/override can resolve it. It reaches the tree only via @itk-wasm/dam, a
build/data-asset extraction tool under @cornerstonejs/labelmap-interpolation.

Add GHSA-mp2f-45pm-3cg9 to the existing pnpm-workspace.yaml auditConfig
ignoreGhsas accepted-risk list, matching how the repo already exempts other
build-tooling advisories. `pnpm audit --audit-level high` now passes locally
(1 critical ignored, 0 high).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* test(e2e): fix visitStudy URL encoding that broke mpr2 study load

The visitStudy rewrite (added for the ?customization= option) built the URL
with new URLSearchParams({ StudyInstanceUIDs: studyInstanceUID }), which
percent-encodes the value. mpr2.spec.ts embeds an extra param in the UID
string ('<uid>&hangingprotocolid=mpr'), so the & and = were encoded and the
whole thing collapsed into one invalid StudyInstanceUIDs value -> the study
could not be found ('studies are not available'), the viewer never rendered,
and the side-panel-header-right click timed out.

Restore master's raw concatenation for StudyInstanceUIDs (so embedded params
survive as separate query params) while still appending the customization
option separately. Only mpr2 embeds & in the UID, matching the single failure.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* PR comments

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

platform/app/public/config/customization.js

@@ -11,11 +11,44 @@ window.config = {
   strictZSpacingForVolumeViewport: true,
   // filterQueryParam: false,
 
-  // Add some customizations to the default e2e datasource
-  customizationService: [
-    '@ohif/extension-default.customizationModule.datasources',
-    '@ohif/extension-default.customizationModule.helloPage',
-  ],
+  // Allowlist for the `?customization=` URL parameter and for
+  // `customizationService.requires` below. The `default` prefix (no slashes)
+  // resolves a value to `<publicUrl>/customizations/<value>.jsonc`. Files are
+  // fetched as DATA (JSON with comments) and never executed.
+  customizationUrlPrefixes: {
+    default: './customizations/',
+  },
+
+  // Phase-tagged startup customizations. Each block is applied at a fixed point
+  // in the lifecycle so ordering is deterministic regardless of when extensions
+  // and modes load:
+  //   - requires:     URL customization data files to resolve up front.
+  //   - bootstrap:    applied (Global) BEFORE extensions register.
+  //   - global:       applied (Global) AFTER extensions register.
+  //   - mode:         applied (Mode) on each mode enter — `*` (general) first,
+  //                   then a block keyed by the mode id / routeName.
+  customizationService: {
+    // Pulls in platform/app/public/customizations/patientBirthDate.jsonc, which
+    // adds a "Birth Date" column to the WorkList study list (global phase).
+    requires: ['patientBirthDate'],
+
+    // The previous (legacy-array) customizations, now in the explicit `global`
+    // phase. A `global` block accepts the same input as setCustomizations: an
+    // array mixing string references and inline object maps.
+    global: [
+      '@ohif/extension-default.customizationModule.datasources',
+      '@ohif/extension-default.customizationModule.helloPage',
+    ],
+
+    // Example of mode-scoped customizations (cleared/reapplied per mode):
+    // the `*` block applies to every mode first; a mode-named block (matched
+    // against the mode id or routeName, e.g. 'viewer') applies after it.
+    //
+    // mode: {
+    //   '*': { 'someCustomizationId': { $set: 'applies to all modes' } },
+    //   viewer: { 'someCustomizationId': { $set: 'overrides for the viewer mode' } },
+    // },
+  },
 
   defaultDataSourceName: 'e2e',
   investigationalUseDialog: {