feat(timetable): observers — engagement denorm/guard + performance version bump

ArtistEngagementObserver:
- creating: auto-fills organisation_id from parent Artist (RFC v0.2 D10
  denormalisation), asserts artist.organisation_id == event.organisation_id;
  cross-tenant linkage throws CrossTenantEngagementException (extends
  DomainException, included in this commit).
- saving: no-op marker reserved for Session 2 state-machine validation.
- deleted: cascades soft-delete to Performance children, hard-deletes
  AdvanceSection children. AdvanceSubmission rows are immutable per
  RFC §5.4 and remain attached.

PerformanceObserver:
- saving: increments version by 1 on UPDATE only (D14 optimistic lock).
  MoveTimetablePerformanceRequest in Session 2 uses this for concurrent-
  edit detection.

Both observers registered in AppServiceProvider::boot.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

api/app/Observers/ArtistEngagementObserver.php

@@ -0,0 +1,61 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Observers;
+
+use App\Exceptions\Artist\CrossTenantEngagementException;
+use App\Models\ArtistEngagement;
+use App\Models\Scopes\OrganisationScope;
+
+/**
+ * Observer for ArtistEngagement.
+ *
+ * On `creating`: denormalises `organisation_id` from the parent Artist
+ * (RFC v0.2 D10) and asserts artist.organisation_id === event.organisation_id.
+ *
+ * On `deleted` (soft delete): cascade soft-delete to child Performance
+ * rows; hard-delete child AdvanceSection rows (RFC §5.4 — sections have
+ * no soft delete). Child AdvanceSubmission rows are immutable audit
+ * records and remain attached to their (now-deleted) section reference
+ * by FK — this is the audit-retention compliance path.
+ */
+final class ArtistEngagementObserver
+{
+    public function creating(ArtistEngagement $engagement): void
+    {
+        $artist = $engagement->artist()->withoutGlobalScope(OrganisationScope::class)->first();
+        $event = $engagement->event()->withoutGlobalScope(OrganisationScope::class)->first();
+
+        if ($artist === null || $event === null) {
+            return;
+        }
+
+        if ($engagement->organisation_id === null) {
+            $engagement->organisation_id = $artist->organisation_id;
+        }
+
+        if ($artist->organisation_id !== $event->organisation_id) {
+            $engagement->setRelation('artist', $artist);
+            $engagement->setRelation('event', $event);
+            throw CrossTenantEngagementException::forEngagement($engagement);
+        }
+    }
+
+    /**
+     * Reserved for Session 2 state-machine validation when
+     * `booking_status` transitions land. No-op for now.
+     */
+    public function saving(ArtistEngagement $engagement): void
+    {
+        // intentionally empty — see class docblock
+    }
+
+    public function deleted(ArtistEngagement $engagement): void
+    {
+        if (! $engagement->isForceDeleting() && $engagement->trashed()) {
+            $engagement->performances()->delete();
+            $engagement->advanceSections()->delete();
+        }
+    }
+}