feat(form-builder): add PurposeSubjectResolver per purpose (WS-6)

Parallel interface to PurposeGuardProvider for runtime subject
resolution. Seven concrete resolvers, one per v1.0 purpose. Wired
through purposes.php via subject_resolver_class key.

EventRegistration uses PersonProvisioner (may create). Other purposes
resolve from existing context (portal token, production request, auth).
IncidentReport is the only purpose allowed to return null (anonymous-
allowed configurations); the others return concrete model types
(narrowed via PHP covariance) for caller convenience.

Refs: RFC-WS-6.md §3 (Q9)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

api/app/FormBuilder/Purposes/PurposeSubjectResolver.php

@@ -0,0 +1,27 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\FormBuilder\Purposes;
+
+use App\Models\FormBuilder\FormSubmission;
+use Illuminate\Database\Eloquent\Model;
+
+/**
+ * RFC-WS-6 §3 (Q9) — parallel interface to PurposeGuardProvider for
+ * runtime subject resolution. PurposeDefinition stays a frozen value
+ * object; this contract lives separately.
+ *
+ * Returns null only for purposes that allow anonymous submissions
+ * (currently incident_report). All other purposes throw on failure.
+ *
+ * Called from inside FormBindingApplicator within a DB::transaction so
+ * any lockForUpdate semantics persist.
+ */
+interface PurposeSubjectResolver
+{
+    /**
+     * @throws \App\Exceptions\FormBuilder\PurposeSubjectResolutionException
+     */
+    public function resolveOrProvision(FormSubmission $submission): ?Model;
+}