fix: route controller exceptions through sentry-laravel reporter

PR-2 follow-up. The PR-2 backend SDK install passed unit tests because
they exercised the scrubber and the BindSentryContext scope writer in
isolation, but live exceptions from controllers never reached
GlitchTip — they were correctly logged to laravel.log but the report()
call had no Sentry-aware reporter to invoke.

Root cause: sentry-laravel 4.x does NOT auto-register an exception
reporter. The host application is required to wire Integration::handles
inside withExceptions in bootstrap/app.php (per the package README and
Sentry docs). Without it, report and Laravels automatic
report-before-render flow only hit the default log channel.

Fix: add Integration::handles at the top of withExceptions so
sentry-laravel registers a reportable callback that calls
captureUnhandledException for every reported throwable. Filtering
remains downstream:
  - ignore_exceptions in config/sentry.php drops Validation,
    Authentication, Authorization (RFC §3.10).
  - SentryEventScrubber::scrub returns null for sub-500 HttpException
    via the before_send hook (RFC §3.7).

Regression coverage: tests/Feature/Observability/ExceptionReportingTest
installs a real Sentry client with a recording before_send and exercises
the full request to capture pipeline through the auth and sentry.context
middleware. Five cases: RuntimeException IS captured (with §3.6 tags
attached), ValidationException is not, NotFoundHttpException 404 is
not, AuthorizationException 403 is not, request-context tags ride along
on the captured event.

Test count: 1532 to 1537. Larastan clean. Pint clean.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

api/bootstrap/app.php

@@ -48,6 +48,16 @@ return Application::configure(basePath: dirname(__DIR__))
         ]);
     })
     ->withExceptions(function (Exceptions $exceptions): void {
+        // RFC-WS-7 §3.10 — bridge Laravel's exception handler into
+        // sentry-laravel so report($e) and Laravel's automatic
+        // report-before-render flow reach GlitchTip. sentry-laravel 4.x
+        // does NOT auto-register this; the README installation snippet
+        // requires the host application to wire it explicitly.
+        // Filtering happens downstream of this hook: ignore_exceptions in
+        // config/sentry.php drops Validation/Auth/AuthZ; SentryEventScrubber
+        // drops sub-500 HttpExceptions via the before_send hook.
+        \Sentry\Laravel\Integration::handles($exceptions);
+
         // Public Form Builder standardised error envelope (S2c D6).
         $exceptions->render(function (\App\Exceptions\FormBuilder\PublicFormApiException $e, Request $request) {
             $body = [