feat(form-builder): identity-match listener + identity_match_status column

S2c D9. Implements ARCH §31.1 — identity matching triggered on
FormSubmissionSubmitted for event_registration schemas.

- Migration 2026_04_22_100000: add form_submissions.identity_match_status
  (nullable string(20), pending|matched|none) + index
  (form_schema_id, identity_match_status).
- Migration 2026_04_22_100001: replace the composite index on
  (form_schema_id, idempotency_key) with a UNIQUE constraint so the DB
  itself is the race-safe backstop behind the application-level
  idempotency replay.
- Listener TriggerPersonIdentityMatchOnFormSubmit: runs only when
  form_schema.purpose === event_registration. For person-subject
  submissions it calls PersonIdentityService::detectMatches and writes
  matched/pending/none; for public (subject=null) it records 'pending'
  so the portal can message the submitter that matching will complete
  when the organiser attaches a person. Failures log at error level
  and never rethrow — sibling listeners on the same event (§31.10
  TAG_PICKER sync) still run.
- AppServiceProvider wires the listener alongside
  SyncTagPickerSelectionsOnSubmit.
- FormSubmission.$fillable gains identity_match_status.

Rationale for a dedicated column (over JSON on submission.metadata):
the matrix is a hard-typed 3-state enum that the public API surfaces
directly, and we want to index it to show organiser dashboards "how
many submissions are pending identity-confirmation".

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

api/database/migrations/2026_04_22_100000_add_identity_match_status_to_form_submissions.php

@@ -0,0 +1,34 @@
+<?php
+
+declare(strict_types=1);
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('form_submissions', function (Blueprint $table): void {
+            // ARCH §31.1 + §31.10 integration signal. Populated by
+            // TriggerPersonIdentityMatchOnFormSubmit on the
+            // FormSubmissionSubmitted event; surfaced to the portal via
+            // PublicFormSubmissionResource.identity_match.
+            // Values: null | 'pending' | 'matched' | 'none'
+            $table->string('identity_match_status', 20)->nullable()->after('anonymised_at');
+            $table->index(
+                ['form_schema_id', 'identity_match_status'],
+                'fs_schema_identity_match_idx',
+            );
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('form_submissions', function (Blueprint $table): void {
+            $table->dropIndex('fs_schema_identity_match_idx');
+            $table->dropColumn('identity_match_status');
+        });
+    }
+};

api/database/migrations/2026_04_22_100001_add_idempotency_key_unique_to_form_submissions.php

@@ -0,0 +1,43 @@
+<?php
+
+declare(strict_types=1);
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        // S2c D4: a UNIQUE (form_schema_id, idempotency_key) is the race-
+        // safe backstop behind application-level idempotency replay. MySQL
+        // treats NULL as distinct in unique indexes, so rows without an
+        // idempotency_key remain unrestricted.
+        Schema::table('form_submissions', function (Blueprint $table): void {
+            $table->dropIndex('fs_idempotency_idx');
+        });
+
+        Schema::table('form_submissions', function (Blueprint $table): void {
+            $table->unique(
+                ['form_schema_id', 'idempotency_key'],
+                'fs_idempotency_unique',
+            );
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('form_submissions', function (Blueprint $table): void {
+            $table->dropUnique('fs_idempotency_unique');
+        });
+
+        Schema::table('form_submissions', function (Blueprint $table): void {
+            $table->index(
+                ['form_schema_id', 'idempotency_key'],
+                'fs_idempotency_idx',
+            );
+        });
+    }
+};