test(form-builder): feature suites + integration contracts incl. FORM-02 (§31.10)

Phase 6 of S2b. 37 new tests, 820 → 857 passing across the suite.

Feature suites (api/tests/Feature/FormBuilder/):
- FormSchemaApiTest: CRUD, publish/unpublish, rotate-public-token (with
  grace window), edit-lock conflict, typed-confirmation delete, 401 on
  unauthenticated, 403 on outsider.
- FormFieldApiTest: create, reorder, binding-change guard (422 w/o force,
  200 with force), conditional_logic cycle rejection, 401 unauth.
- FormSubmissionApiTest: draft → values → submit stores schema snapshot +
  version; review records reviewer; delegation creates active row; draft
  update blocked for non-subject non-delegatee (403).
- FormValueSecurityTest: FieldAccessService hides admin-only fields from
  non-admin; subject-self bypass; admin-only field leaks through neither
  admin list nor non-admin detail responses (§22.9 intent).
- PublicFormApiTest: portal-visible non-admin fields only; unknown token
  → 404; happy-path submission; expired-previous-token → 410; grace
  window still allows submission.
- FormSchemaWebhookApiTest: url/secret NEVER returned in resources;
  DeliverFormWebhookJob rejects 10.x private-ip SSRF (response_body_excerpt
  logs rejection).
- FilterRegistryApiTest: response shape includes tags + form_field
  sources; form_field filter registers.

Integration contract (§31.10):
- TagPickerSyncListenerTest: 5 cases proving (a) no-op on user_id=null,
  (b) sync on submit, (c) deferred sync via
  PersonIdentityService::confirmMatch, (d) organiser_assigned tags
  preserved on rebuild, (e) idempotent rerun.

Fixes discovered while writing tests:
- SyncTagPickerSelectionsOnSubmit: removed hardcoded connection='redis'
  so tests run via sync queue (QUEUE_CONNECTION fallback).
- FormSubmissionService: corrected FormSubmissionReviewed / DraftUpdated
  event signatures to match S1 event classes.
- FormSubmission model: added schema_version_at_submit / snapshot /
  anonymised_at / submission_duration_seconds / auto_save_count to
  $fillable so bulk operations + factory states populate consistently.
- FormSchema: added version, edit_lock_user_id, edit_lock_expires_at to
  $fillable; factory now sets version=1 explicitly.
- FormValueService: public submission path (actor=null) enforces
  is_portal_visible=true AND is_admin_only=false at the write layer
  instead of running FieldAccessService against a null user.
- MigrationRollbackTest: target the S2a drop migration by filename.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

api/tests/Feature/FormBuilder/FormSchemaWebhookApiTest.php

@@ -0,0 +1,84 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tests\Feature\FormBuilder;
+
+use App\Jobs\FormBuilder\DeliverFormWebhookJob;
+use App\Models\FormBuilder\FormSchema;
+use App\Models\FormBuilder\FormSchemaWebhook;
+use App\Models\FormBuilder\FormWebhookDelivery;
+use App\Models\Organisation;
+use App\Models\User;
+use Database\Seeders\RoleSeeder;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Laravel\Sanctum\Sanctum;
+use Tests\TestCase;
+
+final class FormSchemaWebhookApiTest extends TestCase
+{
+    use RefreshDatabase;
+
+    private Organisation $org;
+
+    private User $admin;
+
+    private FormSchema $schema;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        $this->seed(RoleSeeder::class);
+        $this->org = Organisation::factory()->create();
+        $this->admin = User::factory()->create();
+        $this->org->users()->attach($this->admin, ['role' => 'org_admin']);
+        $this->admin->assignRole('org_admin');
+        $this->schema = FormSchema::factory()->create(['organisation_id' => $this->org->id]);
+    }
+
+    public function test_store_creates_webhook(): void
+    {
+        Sanctum::actingAs($this->admin);
+
+        $response = $this->postJson(
+            "/api/v1/organisations/{$this->org->id}/forms/schemas/{$this->schema->id}/webhooks",
+            [
+                'name' => 'Zapier test',
+                'trigger_event' => 'submission_submitted',
+                'url' => 'https://hooks.example.com/zap',
+                'secret' => 'super-secret',
+                'is_active' => true,
+            ],
+        );
+
+        $response->assertCreated();
+        // Resource must NOT leak url or secret.
+        $this->assertArrayNotHasKey('url', (array) $response->json('data'));
+        $this->assertArrayNotHasKey('secret', (array) $response->json('data'));
+        $this->assertSame('hooks.example.com', $response->json('data.url_host'));
+        $this->assertTrue($response->json('data.has_secret'));
+    }
+
+    public function test_delivery_job_rejects_private_ip_url(): void
+    {
+        $webhook = FormSchemaWebhook::factory()->create([
+            'form_schema_id' => $this->schema->id,
+            'url' => 'http://10.0.0.5/evil',
+        ]);
+        /** @var FormWebhookDelivery $delivery */
+        $delivery = FormWebhookDelivery::create([
+            'form_schema_webhook_id' => $webhook->id,
+            'form_submission_id' => \App\Models\FormBuilder\FormSubmission::factory()->create(['form_schema_id' => $this->schema->id])->id,
+            'trigger_event' => 'submission_submitted',
+            'status' => 'pending',
+            'attempts' => 0,
+            'payload_snapshot' => ['event' => 'test'],
+        ]);
+
+        (new DeliverFormWebhookJob($delivery->id))->handle();
+
+        $fresh = $delivery->fresh();
+        $this->assertSame('failed', $fresh->status instanceof \BackedEnum ? $fresh->status->value : $fresh->status);
+        $this->assertStringContainsString('SSRF', (string) $fresh->response_body_excerpt);
+    }
+}