feat(form-builder): form_field_conditional_logic_{groups,conditions} tables + OrganisationScope cap raise to 5

WS-5c commit 1 of 4 — relational infrastructure for the conditional-
logic tree that replaces form_fields.conditional_logic JSON (ARCH-
FORM-BUILDER §8; addendum Q3 WS-5c).

Tables: groups (nesting via parent_group_id) + conditions (leaves,
value JSON nullable for empty/not_empty). Simple FK to form_fields —
addendum Q3 explicitly excludes form_field_library from conditional_
logic scope, so no polymorphic morph here.

OrganisationScope cap raised 3 → 5 hops. The conditions chain is
4 hops (condition → group → field → schema → organisation_id column)
and the new cap gives headroom for future deeper trees without
denormalising form_field_id onto conditions.

Cascade observer (FormFieldChildTablesCascadeObserver) extended to
physically delete the new groups table on FormField delete (hard or
soft). Conditions cascade automatically via the group_id FK on the
groups table.

Factories: FormFieldConditionalLogicGroupFactory, FormFieldConditional
LogicConditionFactory, and FormFieldFactory::withConditionalLogic($tree)
for concise test fixtures.

Tests: 16 new under tests/Feature/FormBuilder/ConditionalLogic/
(relation, scope, cascade, enum catalogue). 3 new scope-cap tests in
ScopeLeakageTest verify 4/5-hop chains pass and 6-hop throws. Hardcoded
rollback step counts in WS-5a/b migration tests bumped for the 2 new
WS-5c migrations. Baseline 1104 → 1122 green (2988 → 3032 assertions).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

api/tests/Feature/MultiTenancy/ScopeLeakageTest.php

@@ -454,31 +454,106 @@ final class ScopeLeakageTest extends TestCase
         $this->assertSame(1, PersonIdentityMatch::query()->count());
     }
 
-    public function test_resolver_raises_on_over_deep_chain(): void
+    public function test_resolver_resolves_four_hop_chain_within_cap(): void
     {
-        // Construct a synthetic 5-hop chain by subclassing on the fly:
-        // A → B → C → D → E (column). The resolver caps at 3 hops and
-        // must raise TenantScopeResolutionException.
-        $fiveHopModel = new class extends Model {
-            protected $table = 'form_value_options';
-            public static function tenantScopeStrategy(): array
-            {
-                return ['via' => FiveHopLevel2::class, 'fk' => 'form_value_id'];
-            }
-        };
+        // 4 via-hops + terminal column = legitimate tree inside the cap.
+        // Build the query and assert no exception; the SQL references every
+        // intermediate table, proving the walker reached the terminal.
+        $scope = new OrganisationScope($this->orgA->id);
+        $builder = (new FourHopLevel1())::query();
 
-        $scope = new OrganisationScope('01HZ01HZ01HZ01HZ01HZ01HZ01');
-        $builder = $fiveHopModel::query();
+        $scope->apply($builder, new FourHopLevel1());
+
+        $sql = $builder->toSql();
+        $this->assertStringContainsString('form_value_options', $sql);
+        $this->assertStringContainsString('form_values', $sql);
+        $this->assertStringContainsString('form_submissions', $sql);
+        $this->assertStringContainsString('form_schemas', $sql);
+        $this->assertStringContainsString('organisation_id', $sql);
+    }
+
+    public function test_resolver_resolves_five_hop_chain_at_cap(): void
+    {
+        // 5 via-hops + terminal column — right at the cap ceiling.
+        $scope = new OrganisationScope($this->orgA->id);
+        $builder = (new FiveHopLevel1())::query();
+
+        $scope->apply($builder, new FiveHopLevel1());
+
+        $this->assertStringContainsString('organisation_id', $builder->toSql());
+    }
+
+    public function test_resolver_raises_when_chain_exceeds_cap(): void
+    {
+        // 6 via-hops — one past the cap of 5. Must raise.
+        $scope = new OrganisationScope($this->orgA->id);
+        $builder = (new SevenHopLevel1())::query();
 
         $this->expectException(TenantScopeResolutionException::class);
-        $scope->apply($builder, $fiveHopModel);
+        $scope->apply($builder, new SevenHopLevel1());
     }
 }
 
 /**
- * Synthetic chain model for the over-deep-chain test — four levels
- * above a terminal column, so resolver walks past its cap.
+ * Synthetic chain models for the scope-cap tests. Tables referenced
+ * exist in the schema so query compilation succeeds; the intermediate
+ * relations are never actually executed in these tests (we assert on
+ * compiled SQL, not on rows).
+ *
+ * FourHopLevel1 → Level2 → Level3 → Level4 (terminal column).
+ * FiveHopLevel1 → Level2 → Level3 → Level4 → Level5 (terminal column).
+ * SevenHopLevel1 → ... → Level7 (terminal column) — exceeds cap=5.
  */
+final class FourHopLevel1 extends Model
+{
+    protected $table = 'form_value_options';
+
+    public static function tenantScopeStrategy(): array
+    {
+        return ['via' => FourHopLevel2::class, 'fk' => 'form_value_id'];
+    }
+}
+
+final class FourHopLevel2 extends Model
+{
+    protected $table = 'form_values';
+
+    public static function tenantScopeStrategy(): array
+    {
+        return ['via' => FourHopLevel3::class, 'fk' => 'form_submission_id'];
+    }
+}
+
+final class FourHopLevel3 extends Model
+{
+    protected $table = 'form_submissions';
+
+    public static function tenantScopeStrategy(): array
+    {
+        return ['via' => FourHopLevel4::class, 'fk' => 'form_schema_id'];
+    }
+}
+
+final class FourHopLevel4 extends Model
+{
+    protected $table = 'form_schemas';
+
+    public static function tenantScopeStrategy(): array
+    {
+        return ['column' => 'organisation_id'];
+    }
+}
+
+final class FiveHopLevel1 extends Model
+{
+    protected $table = 'form_value_options';
+
+    public static function tenantScopeStrategy(): array
+    {
+        return ['via' => FiveHopLevel2::class, 'fk' => 'form_value_id'];
+    }
+}
+
 final class FiveHopLevel2 extends Model
 {
     protected $table = 'form_values';
@@ -505,16 +580,86 @@ final class FiveHopLevel4 extends Model
 
     public static function tenantScopeStrategy(): array
     {
-        return ['via' => FiveHopLevel5::class, 'fk' => 'organisation_id'];
+        return ['via' => FiveHopLevel5::class, 'fk' => 'id'];
     }
 }
 
 final class FiveHopLevel5 extends Model
 {
-    protected $table = 'organisations';
+    protected $table = 'form_schemas';
 
     public static function tenantScopeStrategy(): array
     {
-        return ['column' => 'id'];
+        return ['column' => 'organisation_id'];
+    }
+}
+
+final class SevenHopLevel1 extends Model
+{
+    protected $table = 'form_value_options';
+
+    public static function tenantScopeStrategy(): array
+    {
+        return ['via' => SevenHopLevel2::class, 'fk' => 'form_value_id'];
+    }
+}
+
+final class SevenHopLevel2 extends Model
+{
+    protected $table = 'form_values';
+
+    public static function tenantScopeStrategy(): array
+    {
+        return ['via' => SevenHopLevel3::class, 'fk' => 'form_submission_id'];
+    }
+}
+
+final class SevenHopLevel3 extends Model
+{
+    protected $table = 'form_submissions';
+
+    public static function tenantScopeStrategy(): array
+    {
+        return ['via' => SevenHopLevel4::class, 'fk' => 'form_schema_id'];
+    }
+}
+
+final class SevenHopLevel4 extends Model
+{
+    protected $table = 'form_schemas';
+
+    public static function tenantScopeStrategy(): array
+    {
+        return ['via' => SevenHopLevel5::class, 'fk' => 'id'];
+    }
+}
+
+final class SevenHopLevel5 extends Model
+{
+    protected $table = 'form_schemas';
+
+    public static function tenantScopeStrategy(): array
+    {
+        return ['via' => SevenHopLevel6::class, 'fk' => 'id'];
+    }
+}
+
+final class SevenHopLevel6 extends Model
+{
+    protected $table = 'form_schemas';
+
+    public static function tenantScopeStrategy(): array
+    {
+        return ['via' => SevenHopLevel7::class, 'fk' => 'id'];
+    }
+}
+
+final class SevenHopLevel7 extends Model
+{
+    protected $table = 'form_schemas';
+
+    public static function tenantScopeStrategy(): array
+    {
+        return ['column' => 'organisation_id'];
     }
 }