feat(form-builder): add PurposeSubjectResolver per purpose (WS-6)

Parallel interface to PurposeGuardProvider for runtime subject
resolution. Seven concrete resolvers, one per v1.0 purpose. Wired
through purposes.php via subject_resolver_class key.

EventRegistration uses PersonProvisioner (may create). Other purposes
resolve from existing context (portal token, production request, auth).
IncidentReport is the only purpose allowed to return null (anonymous-
allowed configurations); the others return concrete model types
(narrowed via PHP covariance) for caller convenience.

Refs: RFC-WS-6.md §3 (Q9)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

api/app/FormBuilder/Purposes/Resolvers/UserProfileSubjectResolver.php

@@ -0,0 +1,48 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\FormBuilder\Purposes\Resolvers;
+
+use App\Exceptions\FormBuilder\PurposeSubjectResolutionException;
+use App\FormBuilder\Purposes\PurposeSubjectResolver;
+use App\Models\FormBuilder\FormSubmission;
+use App\Models\User;
+use Illuminate\Database\Eloquent\Model;
+
+/**
+ * RFC §3 Q9 — user_profile: subject is the authenticated User.
+ */
+final readonly class UserProfileSubjectResolver implements PurposeSubjectResolver
+{
+    public function resolveOrProvision(FormSubmission $submission): User
+    {
+        if ($submission->subject_type === 'user' && $submission->subject_id !== null) {
+            $subject = $submission->subject;
+            if ($subject instanceof User) {
+                return $subject;
+            }
+        }
+
+        if ($submission->submitted_by_user_id === null) {
+            throw new PurposeSubjectResolutionException(
+                'user_profile',
+                'no_auth',
+                (string) $submission->id,
+                'user_profile submission has no authenticated User',
+            );
+        }
+
+        $user = User::query()->find($submission->submitted_by_user_id);
+        if (! $user instanceof User) {
+            throw new PurposeSubjectResolutionException(
+                'user_profile',
+                'no_auth',
+                (string) $submission->id,
+                "submitted_by_user_id {$submission->submitted_by_user_id} not found",
+            );
+        }
+
+        return $user;
+    }
+}