feat(form-builder): denormalize organisation_id and event_id on form_submissions per addendum Q2

Adds direct tenant + event columns to form_submissions so rapportage-hot
aggregate queries (dashboards, CSV-exports, counts over thousands of rows
per org or per event) skip the form_schemas join. This is the single
denormalization exception per addendum Q2; every other form-builder child
table continues to resolve tenancy via FK-chain through its parent
(implemented in Commit 3).

Schema:
- form_submissions.organisation_id  ULID FK → organisations, cascade delete, NOT NULL
- form_submissions.event_id          ULID FK → events, null on delete, nullable
- Indexes: (organisation_id, status), (event_id, status)

Observer: App\Observers\FormBuilder\FormSubmissionObserver::creating
resolves both columns when the caller has not set them.
  - organisation_id <- form_schema.organisation_id (always present —
    form_schemas carries OrganisationScope's column directly)
  - event_id <- schema.owner_id when owner_type === 'event'; else the
    active route's {event} parameter; else null (user_profile /
    signature_contract purposes)
The observer docblock spells out both resolution paths and is covered
by the observer test below.

Model: FormSubmission gains organisation_id + event_id in $fillable, a
belongsTo organisation() and belongsTo event() relation.

Factory: FormSubmissionFactory gains forOrganisation($org) and
forEvent($event) states for tests that need to override the observer's
automatic resolution (e.g. cross-org leakage scenarios in Commit 3).
Normal factory usage does not need the states — the observer populates
both fields on save.

Docs:
- SCHEMA.md §3.5.12 form_submissions table — organisation_id and event_id
  inserted between form_schema_id and subject_type; indexes added;
  addendum Q2 rationale paragraph at the bottom explaining why this is
  the only denormalized form-builder child.
- ARCH-FORM-BUILDER.md §4.3 — mirror changes + rationale inline on the
  columns and in the indexes list.

Tests: tests/Feature/FormBuilder/FormSubmissionObserverTest.php — 7 tests
covering organisation resolution from schema, event resolution from
event-owned schema, null event_id for non-event-owned schemas without
route context, route-based event resolution, organisation_id populated
on every create path (factory / new() / Model::create), index presence,
and belongsTo relations. 13 new assertions. Full suite: 984 passed
(2675 assertions).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

api/database/factories/FormBuilder/FormSubmissionFactory.php

@@ -5,8 +5,10 @@ declare(strict_types=1);
 namespace Database\Factories\FormBuilder;
 
 use App\Enums\FormBuilder\FormSubmissionStatus;
+use App\Models\Event;
 use App\Models\FormBuilder\FormSchema;
 use App\Models\FormBuilder\FormSubmission;
+use App\Models\Organisation;
 use Illuminate\Database\Eloquent\Factories\Factory;
 
 /** @extends Factory<FormSubmission> */
@@ -40,4 +42,26 @@ final class FormSubmissionFactory extends Factory
     {
         return $this->state(fn () => ['is_test' => true]);
     }
+
+    /**
+     * Force a specific tenant. The observer would otherwise resolve it
+     * from the schema parent; this state lets tests override for edge
+     * cases (e.g. cross-org leakage scenarios in Commit 3).
+     */
+    public function forOrganisation(Organisation $organisation): static
+    {
+        return $this->state(fn () => ['organisation_id' => $organisation->id]);
+    }
+
+    /**
+     * Force a specific event + its organisation. Addendum Q2 contract:
+     * any submission tied to an event also has that event's org.
+     */
+    public function forEvent(Event $event): static
+    {
+        return $this->state(fn () => [
+            'event_id' => $event->id,
+            'organisation_id' => $event->organisation_id,
+        ]);
+    }
 }