feat(form-builder): form_field_conditional_logic_{groups,conditions} tables + OrganisationScope cap raise to 5

WS-5c commit 1 of 4 — relational infrastructure for the conditional-
logic tree that replaces form_fields.conditional_logic JSON (ARCH-
FORM-BUILDER §8; addendum Q3 WS-5c).

Tables: groups (nesting via parent_group_id) + conditions (leaves,
value JSON nullable for empty/not_empty). Simple FK to form_fields —
addendum Q3 explicitly excludes form_field_library from conditional_
logic scope, so no polymorphic morph here.

OrganisationScope cap raised 3 → 5 hops. The conditions chain is
4 hops (condition → group → field → schema → organisation_id column)
and the new cap gives headroom for future deeper trees without
denormalising form_field_id onto conditions.

Cascade observer (FormFieldChildTablesCascadeObserver) extended to
physically delete the new groups table on FormField delete (hard or
soft). Conditions cascade automatically via the group_id FK on the
groups table.

Factories: FormFieldConditionalLogicGroupFactory, FormFieldConditional
LogicConditionFactory, and FormFieldFactory::withConditionalLogic($tree)
for concise test fixtures.

Tests: 16 new under tests/Feature/FormBuilder/ConditionalLogic/
(relation, scope, cascade, enum catalogue). 3 new scope-cap tests in
ScopeLeakageTest verify 4/5-hop chains pass and 6-hop throws. Hardcoded
rollback step counts in WS-5a/b migration tests bumped for the 2 new
WS-5c migrations. Baseline 1104 → 1122 green (2988 → 3032 assertions).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

api/tests/Feature/FormBuilder/ConditionalLogic/FormFieldConditionalLogicScopeTest.php

@@ -0,0 +1,103 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tests\Feature\FormBuilder\ConditionalLogic;
+
+use App\Models\FormBuilder\FormField;
+use App\Models\FormBuilder\FormFieldConditionalLogicCondition;
+use App\Models\FormBuilder\FormFieldConditionalLogicGroup;
+use App\Models\FormBuilder\FormSchema;
+use App\Models\Organisation;
+use App\Models\Scopes\OrganisationScope;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Routing\Route;
+use Tests\TestCase;
+
+/**
+ * Verifies that the OrganisationScope FK-chain resolver (Q2 declarative
+ * strategy) keeps groups AND conditions tenant-isolated. Groups resolve
+ * at 3 hops (group → field → schema → organisation_id); conditions at 4
+ * (condition → group → field → schema → organisation_id). The latter
+ * only fits after WS-5c raised the cap from 3 to 5.
+ */
+final class FormFieldConditionalLogicScopeTest extends TestCase
+{
+    use RefreshDatabase;
+
+    public function test_scope_isolates_groups_per_organisation(): void
+    {
+        [$orgA, $fieldA] = $this->seedOrgWithLogic();
+        [$orgB, $fieldB] = $this->seedOrgWithLogic();
+
+        $this->withOrgRoute($orgA);
+        $fieldIdsA = FormFieldConditionalLogicGroup::query()->pluck('form_field_id')->unique()->values()->all();
+        $this->assertSame([$fieldA->id], $fieldIdsA);
+
+        $this->withOrgRoute($orgB);
+        $fieldIdsB = FormFieldConditionalLogicGroup::query()->pluck('form_field_id')->unique()->values()->all();
+        $this->assertSame([$fieldB->id], $fieldIdsB);
+    }
+
+    public function test_scope_isolates_conditions_per_organisation(): void
+    {
+        [$orgA, $fieldA] = $this->seedOrgWithLogic();
+        $this->seedOrgWithLogic();
+
+        $this->withOrgRoute($orgA);
+        $this->assertSame(
+            1,
+            FormFieldConditionalLogicCondition::query()
+                ->where('field_slug', 'gate')
+                ->count(),
+        );
+    }
+
+    public function test_without_global_scope_exposes_cross_org(): void
+    {
+        [$orgA] = $this->seedOrgWithLogic();
+        $this->seedOrgWithLogic();
+
+        $this->withOrgRoute($orgA);
+
+        $this->assertSame(1, FormFieldConditionalLogicGroup::query()->count());
+        $this->assertSame(
+            2,
+            FormFieldConditionalLogicGroup::query()
+                ->withoutGlobalScope(OrganisationScope::class)
+                ->count(),
+        );
+
+        $this->assertSame(1, FormFieldConditionalLogicCondition::query()->count());
+        $this->assertSame(
+            2,
+            FormFieldConditionalLogicCondition::query()
+                ->withoutGlobalScope(OrganisationScope::class)
+                ->count(),
+        );
+    }
+
+    /** @return array{0:Organisation,1:FormField} */
+    private function seedOrgWithLogic(): array
+    {
+        $org = Organisation::factory()->create();
+        $schema = FormSchema::factory()->create(['organisation_id' => $org->id]);
+        $field = FormField::factory()->create(['form_schema_id' => $schema->id]);
+
+        $root = FormFieldConditionalLogicGroup::factory()->forField($field)->create();
+        FormFieldConditionalLogicCondition::factory()
+            ->inGroup($root)
+            ->forFieldSlug('gate')
+            ->create();
+
+        return [$org, $field];
+    }
+
+    private function withOrgRoute(Organisation $org): void
+    {
+        $route = new Route(['GET'], '/_test', static fn () => null);
+        $route->bind(request());
+        $route->setParameter('organisation', $org);
+        request()->setRouteResolver(static fn () => $route);
+    }
+}