feat(forms): add Eloquent models, observer, events, activity-log helpers

Phase 4 of S1.

Models (app/Models/FormBuilder/): FormSchema, FormSchemaSection, FormField,
FormSubmission, FormValue, FormValueOption, FormTemplate, FormFieldLibrary,
FormSchemaWebhook, FormWebhookDelivery, FormSubmissionSectionStatus,
FormSubmissionDelegation. Plus UserProfile at app/Models/ (user-universal).

OrganisationScope applied on: FormSchema, FormTemplate, FormFieldLibrary.
FormSchemaWebhook documents inherited-scope discipline (OrganisationScope's
strategies — organisation_id/event_id/festival_section_id — don't cover
form_schema_id; direct queries would leak across orgs, so must go via
$schema->webhooks()).

User::profile()/getOrCreateProfile(), Event::formSchemas() (morphMany),
Person::formSubmissions() (morphMany).

Morph map enforced in AppServiceProvider with 28 keys covering every model
that appears as activitylog subject/causer. Also updated
OrganisationDashboardService (and its test) to query activitylog via
getMorphClass() instead of FQCN.

Activity log strategy: nuanced explicit calls (logSchemaChange on FormSchema,
logFieldChange on FormField) — no LogsActivity trait. Suppression for bulk
fixtures via App\Support\ActivityLog::suppressed(fn() => ...) which flips
config('activitylog.enabled') around a callback. Both our explicit calls
and spatie's trait on Organisation respect the flag via ActivityLogger::log().

FormValueObserver (app/Observers/FormBuilder/) populates value_indexed/
value_number/value_date/value_bool on save per field.value_storage_hint,
rebuilds form_value_options pivot on multi-value filterable fields, cleans
up on delete. Memoised field cache avoids N+1. Registered in AppServiceProvider.

9 lightweight event classes (app/Events/FormBuilder/) as SerializesModels
containers — submission lifecycle signatures lock in for S2 services, no
listeners yet.

Factories for all models with Dutch fake data (fake('nl_NL')). FormSchema
factory uses defaultSubmissionMode(); FormField factory uses
recommendedValueStorageHint().

Tests: 9 new observer tests (all pass); full suite 910/910 (up from 901).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

api/app/Providers/AppServiceProvider.php

@@ -4,9 +4,42 @@ declare(strict_types=1);
 
 namespace App\Providers;
 
+use App\Models\Company;
+use App\Models\CrowdList;
+use App\Models\CrowdType;
+use App\Models\EmailChangeRequest;
+use App\Models\EmailLog;
+use App\Models\Event;
+use App\Models\FestivalSection;
+use App\Models\ImpersonationSession;
+use App\Models\Location;
+use App\Models\MfaBackupCode;
+use App\Models\MfaEmailCode;
+use App\Models\Organisation;
+use App\Models\OrganisationEmailSettings;
+use App\Models\OrganisationEmailTemplate;
 use App\Models\Person;
+use App\Models\PersonFieldValue;
+use App\Models\PersonIdentityMatch;
+use App\Models\PersonSectionPreference;
+use App\Models\PersonTag;
+use App\Models\RegistrationFieldTemplate;
+use App\Models\RegistrationFormField;
+use App\Models\Shift;
+use App\Models\ShiftAssignment;
+use App\Models\ShiftWaitlist;
+use App\Models\TimeSlot;
+use App\Models\TrustedDevice;
+use App\Models\User;
+use App\Models\UserInvitation;
+use App\Models\UserOrganisationTag;
+use App\Models\UserProfile;
+use App\Models\FormBuilder\FormValue;
+use App\Models\VolunteerAvailability;
+use App\Observers\FormBuilder\FormValueObserver;
 use App\Observers\PersonObserver;
 use Illuminate\Auth\Notifications\ResetPassword;
+use Illuminate\Database\Eloquent\Relations\Relation;
 use Illuminate\Support\ServiceProvider;
 use Spatie\Activitylog\Models\Activity;
 
@@ -19,7 +52,52 @@ class AppServiceProvider extends ServiceProvider
 
     public function boot(): void
     {
+        // Morph map: explicit keys for every class that can end up in a
+        // polymorphic column. Before S1 there were no morphTo/morphMany
+        // relations, but spatie/activitylog stores subject/causer as morph
+        // columns — so every model passed to performedOn()/causedBy() MUST
+        // be registered. Keep form-builder subject_types in sync with
+        // config/form_subjects.php.
+        Relation::enforceMorphMap([
+            // Form-builder subject types
+            'event' => Event::class,
+            'user' => User::class,
+            'user_profile' => UserProfile::class,
+            'person' => Person::class,
+            'company' => Company::class,
+            'organisation' => Organisation::class,
+            // 'artist' added when artist module lands
+
+            // Additional models used as activity-log subjects/causers
+            'crowd_list' => CrowdList::class,
+            'crowd_type' => CrowdType::class,
+            'email_change_request' => EmailChangeRequest::class,
+            'email_log' => EmailLog::class,
+            'festival_section' => FestivalSection::class,
+            'impersonation_session' => ImpersonationSession::class,
+            'location' => Location::class,
+            'mfa_backup_code' => MfaBackupCode::class,
+            'mfa_email_code' => MfaEmailCode::class,
+            'organisation_email_settings' => OrganisationEmailSettings::class,
+            'organisation_email_template' => OrganisationEmailTemplate::class,
+            'person_field_value' => PersonFieldValue::class,
+            'person_identity_match' => PersonIdentityMatch::class,
+            'person_section_preference' => PersonSectionPreference::class,
+            'person_tag' => PersonTag::class,
+            'registration_field_template' => RegistrationFieldTemplate::class,
+            'registration_form_field' => RegistrationFormField::class,
+            'shift' => Shift::class,
+            'shift_assignment' => ShiftAssignment::class,
+            'shift_waitlist' => ShiftWaitlist::class,
+            'time_slot' => TimeSlot::class,
+            'trusted_device' => TrustedDevice::class,
+            'user_invitation' => UserInvitation::class,
+            'user_organisation_tag' => UserOrganisationTag::class,
+            'volunteer_availability' => VolunteerAvailability::class,
+        ]);
+
         Person::observe(PersonObserver::class);
+        FormValue::observe(FormValueObserver::class);
 
         ResetPassword::createUrlUsing(function ($user, string $token) {
             return config('crewli.portal_url') . '/wachtwoord-resetten?token=' . $token . '&email=' . urlencode($user->email);