feat(form-builder): add pre-publish binding check per purpose

`FormSchemaService::publish()` now verifies that every binding path
declared by the schema's PurposeDefinition::requiredBindings is present
on at least one of the schema's `form_fields.binding` JSON entries.
Missing bindings raise PurposeRequirementsNotMetException with a
structured `purposeSlug` + `missingBindings[]` payload.

v1.0 this is a trivial JSON scan; in WS-5a the check will switch to
the relational `form_field_bindings` table.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

api/app/Exceptions/FormBuilder/PurposeRequirementsNotMetException.php

@@ -0,0 +1,31 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Exceptions\FormBuilder;
+
+use RuntimeException;
+
+/**
+ * Thrown when FormSchemaService::publish() finds a purpose-declared
+ * binding path that is not bound by any field on the schema.
+ *
+ * v1.0: bindings are read from `form_fields.binding` JSON. In WS-5 the
+ * check will switch to the relational `form_field_bindings` table.
+ */
+final class PurposeRequirementsNotMetException extends RuntimeException
+{
+    /**
+     * @param  list<string>  $missingBindings  paths in "{entity}.{attribute}" form
+     */
+    public function __construct(
+        public readonly string $purposeSlug,
+        public readonly array $missingBindings,
+    ) {
+        parent::__construct(sprintf(
+            "Purpose '%s' cannot be published: missing required binding(s): %s",
+            $purposeSlug,
+            implode(', ', $missingBindings),
+        ));
+    }
+}