feat(form-builder): broadcast channel auth + listener layout comment update

Per RFC-WS-6 §Q1 v1.3 addition 2.

- routes/channels.php (NEW): authorization callback for the
  submission.{id} private channel. v1 authz scope is submitter-only
  (matches submitted_by_user_id); org-admin access is deferred per
  BACKLOG TECH-CHANNEL-AUTH-ORG-ADMIN. Frontend Echo subscription
  lands as a separate frontend follow-up.
- bootstrap/app.php: registers routes/channels.php via withRouting()
  channels: parameter. This is NEW broadcasting wiring — Laravel's
  broadcasting auth middleware was not previously connected to the
  framework. Without this registration the channels file is dead code.
- AppServiceProvider:👢 comment block updated to v1.3 listener
  layout (1 sync ApplyBindings + N queued, all gated on
  apply_status=COMPLETED per ARCH-BINDINGS §5.6). Comment on
  TriggerPersonIdentityMatch flipped from "(sync)" to "(queued
  post-v1.3)".

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

api/app/Providers/AppServiceProvider.php

@@ -163,16 +163,24 @@ class AppServiceProvider extends ServiceProvider
         FormField::observe(FormFieldChildTablesCascadeObserver::class);
         FormFieldLibrary::observe(FormFieldChildTablesCascadeObserver::class);
 
-        // RFC-WS-6 §3 (Q1) — sync chain on FormSubmissionSubmitted, in
-        // this exact order:
-        //   1. ApplyBindingsOnFormSubmit                (sync)
-        //   2. TriggerPersonIdentityMatchOnFormSubmit   (sync)
-        // Queued listeners on the same event (SyncTagPickerSelectionsOnSubmit,
-        // future webhook dispatcher, mailables) run in parallel after the
-        // sync chain via the queue. Their relative registration position
-        // is irrelevant.
+        // RFC-WS-6 v1.3 §Q1 — FormSubmissionSubmitted listener layout.
+        //
+        // SYNC chain (single listener):
+        //   1. ApplyBindingsOnFormSubmit
+        //
+        // QUEUED listeners (parallel, all gated on apply_status=COMPLETED
+        // per ARCH-BINDINGS §5.6 — PARTIAL and FAILED both fall through to
+        // the early-return):
+        //   - TriggerPersonIdentityMatchOnFormSubmit (gates + invariant + broadcast)
+        //   - SyncTagPickerSelectionsOnSubmit
+        //
+        // The listener-ordering structural test
+        // (FormSubmissionSubmittedListenerOrderTest) asserts ApplyBindings
+        // is the only sync listener and that every queued listener has
+        // the apply_status=COMPLETED gate as its first executable
+        // statement.
 
-        // RFC Q1 — applies bindings sync before identity match runs.
+        // RFC Q1 — applies bindings sync before queued siblings fire.
         \Illuminate\Support\Facades\Event::listen(
             FormSubmissionSubmitted::class,
             ApplyBindingsOnFormSubmit::class,
@@ -184,7 +192,8 @@ class AppServiceProvider extends ServiceProvider
             SyncTagPickerSelectionsOnSubmit::class,
         );
 
-        // ARCH §31.1 — identity-match trigger on event_registration (sync).
+        // ARCH §31.1 — identity-match trigger on event_registration (queued
+        // post-v1.3; was sync in v1.0/v1.2 layout).
         \Illuminate\Support\Facades\Event::listen(
             FormSubmissionSubmitted::class,
             TriggerPersonIdentityMatchOnFormSubmit::class,