Merge remote-tracking branch 'origin/main' into datatable-roles-redesign

# Conflicts:
#	backend/ee-repo-ref.txt
#	frontend/src/lib/components/InstanceSettings.svelte

backend/windmill-api-workspaces/src/workspaces.rs

@@ -4939,6 +4939,9 @@ async fn edit_guest_access(
     Json(EditGuestAccess { guest_access_enabled }): Json<EditGuestAccess>,
 ) -> Result<String> {
     require_admin(authed.is_admin, &authed.username)?;
+    if guest_access_enabled {
+        windmill_common::workspaces::require_guest_support()?;
+    }
 
     let mut tx = db.begin().await?;
     sqlx::query!(
@@ -4995,6 +4998,11 @@ async fn edit_guest_jwt_key(
             "Set a PEM public key or a JWKS URL, not both".to_string(),
         ));
     }
+    // Clearing stays allowed wherever guests are: a key nobody can use is still worth
+    // removing.
+    if public_key.is_some() || jwks_url.is_some() {
+        windmill_common::workspaces::require_guest_support()?;
+    }
     if let Some(pem) = public_key.as_deref() {
         windmill_common::guest_jwt::decoding_key_from_pem(pem)?;
     }