feat(form-builder): add PurposeSubjectResolver per purpose (WS-6)

Parallel interface to PurposeGuardProvider for runtime subject
resolution. Seven concrete resolvers, one per v1.0 purpose. Wired
through purposes.php via subject_resolver_class key.

EventRegistration uses PersonProvisioner (may create). Other purposes
resolve from existing context (portal token, production request, auth).
IncidentReport is the only purpose allowed to return null (anonymous-
allowed configurations); the others return concrete model types
(narrowed via PHP covariance) for caller convenience.

Refs: RFC-WS-6.md §3 (Q9)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

api/app/FormBuilder/Purposes/Resolvers/IncidentReportSubjectResolver.php

@@ -0,0 +1,46 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\FormBuilder\Purposes\Resolvers;
+
+use App\FormBuilder\Purposes\PurposeSubjectResolver;
+use App\Models\FormBuilder\FormSubmission;
+use App\Models\Person;
+use App\Models\User;
+use Illuminate\Database\Eloquent\Model;
+
+/**
+ * RFC §3 Q9 — incident_report: subject is Person via auth when present;
+ * null when anonymous (the only purpose that may legitimately resolve
+ * to no subject).
+ */
+final readonly class IncidentReportSubjectResolver implements PurposeSubjectResolver
+{
+    public function resolveOrProvision(FormSubmission $submission): ?Model
+    {
+        if ($submission->subject_type === 'person' && $submission->subject_id !== null) {
+            $subject = $submission->subject;
+            if ($subject instanceof Person) {
+                return $subject;
+            }
+        }
+
+        if ($submission->submitted_by_user_id === null) {
+            // Anonymous-allowed: caller (FormBindingApplicator) handles
+            // the null subject path explicitly.
+            return null;
+        }
+
+        $user = User::query()->find($submission->submitted_by_user_id);
+        if (! $user instanceof User) {
+            return null;
+        }
+
+        return Person::query()
+            ->withoutGlobalScopes()
+            ->where('user_id', $user->id)
+            ->where('event_id', $submission->event_id)
+            ->first();
+    }
+}