fix(settings): align field rhythm and report access load failures

Author: waleedlatif1

apps/sim/ee/components/setting-row.tsx

@@ -28,7 +28,7 @@ export function SettingRow({
   children,
 }: SettingRowProps) {
   return (
-    <div className='flex flex-col gap-1.5'>
+    <div className='flex flex-col gap-[9px]'>
       <div className='flex items-center gap-1.5'>
         <Label htmlFor={htmlFor}>
           {label}

apps/sim/ee/credential-groups/components/credential-group-access.test.tsx

@@ -374,4 +374,18 @@ describe('CredentialGroupAccess', () => {
     const failed = renderAccess({ loadError: new Error('Access request failed') })
     expect(failed.container.textContent).toContain('Access request failed')
   })
+
+  /**
+   * These three are `null` until the access query resolves, so a settled read that
+   * still lacks them is a load failure to report — not a throw that blanks the panel
+   * the surrounding tabs render into.
+   */
+  it.each([
+    ['workflows', { workflows: null }],
+    ['allowedWorkflowIds', { allowedWorkflowIds: null }],
+    ['revision', { revision: null }],
+  ] as const)('reports a failed load when %s is missing', (_field, overrides) => {
+    const missing = renderAccess(overrides)
+    expect(missing.container.textContent).toContain("Couldn't load workflow access")
+  })
 })

apps/sim/ee/credential-groups/components/credential-group-access.tsx

@@ -182,9 +182,15 @@ export function CredentialGroupAccess({
     )
   }
   if (isPending) return null
-  if (!workflows) throw new Error('Credential Group workflow catalog is unavailable')
-  if (!allowedWorkflowIds) throw new Error('Credential Group workflow access is unavailable')
-  if (revision === null) throw new Error('Credential Group access revision is unavailable')
+  /**
+   * These three arrive `null` until the access query resolves, so a settled-but-empty
+   * read is a server state the caller can hand us — not a programming fault. It reports
+   * as a failed load rather than throwing, which would blank the whole panel. The
+   * integrity checks below stay throws: those mean the payload itself is corrupt.
+   */
+  if (!workflows || !allowedWorkflowIds || revision === null) {
+    return <SettingsEmptyState tone='error'>Couldn't load workflow access</SettingsEmptyState>
+  }
 
   const allowedWorkflowIdSet = new Set(allowedWorkflowIds)
   if (allowedWorkflowIdSet.size !== allowedWorkflowIds.length) {

apps/sim/ee/credential-groups/components/credential-group-detail.tsx

@@ -305,7 +305,6 @@ export function CredentialGroupDetail({
           onSelect: () => guard.guardBack(onBack),
         }}
         title={credentialGroup?.name ?? 'Credential group'}
-        description={credentialGroup?.description ?? undefined}
         actions={actions}
         search={
           activeTab === 'details'