feat(scope): declarative FK-chain strategy for OrganisationScope, register on 14 models per addendum Q2 + D-03/D-04

Refactors OrganisationScope to support a declarative, recursive FK-chain
resolver and registers the scope on 14 models that previously relied on
caller-discipline for tenant isolation.

Scope resolver (app/Models/Scopes/OrganisationScope.php):
Models now declare their strategy via:

    public static function tenantScopeStrategy(): array
    {
        return ['column' => 'organisation_id'];           // terminal
        // OR
        return ['via' => FormSchema::class, 'fk' => 'form_schema_id'];
    }

The apply() path walks the chain recursively, building whereIn subqueries
against parent models until it hits a column-based strategy. Max 3 hops;
deeper chains raise App\Exceptions\TenantScopeResolutionException. The
walker accepts BOTH the new tenantScopeStrategy() and the legacy
$organisationScopeColumn property at every hop — so PersonIdentityMatch
can chain via Person, which still uses the legacy event_id bridge, without
requiring Person/Event/Shift/FestivalSection/TimeSlot to migrate to the
new convention in this work package. That migration is a separate
backlog ticket — explicitly scope-controlled per the addendum.

Fourteen newly-scoped models:

  Form-builder child models (D-03):
    FormSchemaSection             via FormSchema                    (1 hop)
    FormField                     via FormSchema                    (1 hop)
    FormSubmission                column organisation_id (Commit 2)
    FormValue                     via FormSubmission                (1 hop)
    FormValueOption               via FormValue -> FormSubmission   (2 hops)
    FormSubmissionSectionStatus   via FormSubmission                (1 hop)
    FormSubmissionDelegation      via FormSubmission                (1 hop)
    FormSchemaWebhook             via FormSchema                    (1 hop)
    FormWebhookDelivery           via FormSubmission                (1 hop)

  Event-data models (D-04 event-data subset):
    ShiftAssignment               via Shift (legacy festival_section_id)
    ShiftWaitlist                 via Shift
    VolunteerAvailability         via TimeSlot (legacy event_id)
    PersonSectionPreference       via FestivalSection (legacy event_id)
    PersonIdentityMatch           via Person (legacy event_id)

Note — task directive specified VolunteerAvailability "via: Event, fk: event_id",
but the table has no event_id column (only person_id + time_slot_id).
Rerouted via TimeSlot, which carries the legacy event_id bridge; same
end result, correct FK.

Security-relevant callers made explicit:
  PublicFormSchemaResource::toArray() now eagerly loads fields + sections
  with withoutGlobalScope(OrganisationScope::class). Prior to this commit
  the public form endpoint silently relied on those relations being
  unscoped. The PublicFormCrossOrgScopeTest pre-existing assertions still
  pass — behaviour unchanged, intent now explicit.

Test fix: FormSchemaApiTest::test_publish_sets_is_published_true was
flaky (factory randomly picked EVENT_REGISTRATION which requires
bindings). Pinned to USER_PROFILE for determinism; PurposeSchemaLifecycleTest
covers the binding-enforcement path.

Test flip: MultiTenancyTest::test_form_schema_webhook_is_not_globally_scoped
renamed to is_scoped_via_fk_chain and asserts the new behaviour: scope
filters by route org, withoutGlobalScope() still exposes cross-org rows.
The test's original purpose ("pin current behaviour so a future refactor
is intentional") is now satisfied by Commit 3 being that intentional
refactor.

Docs:
  SCHEMA.md §3.5.11 Rule 5 — tenantScopeStrategy() convention documented;
    the 14 newly-scoped models enumerated; link to addendum Q2.
  ARCH-FORM-BUILDER.md §4.14 — new section "Multi-tenancy scope chain"
    with the hop-count table for all 14 chains and the withoutGlobalScope
    pattern for cross-org callers.

Tests: tests/Feature/MultiTenancy/ScopeLeakageTest.php — two orgs with
fully-populated record chains down to each of the 14 leaf models; asserts
scoped queries never cross, withoutGlobalScope still does. Plus: three-
hop chain (FormValueOption) explicitly exercised, legacy-column bridge
verified, over-deep chain raises TenantScopeResolutionException. 16 tests /
31 new assertions. Full suite: 1000 passed (2706 assertions).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

dev-docs/ARCH-FORM-BUILDER.md

@@ -992,6 +992,50 @@ update-request. Rejects keys not in whitelist with 422.
 
 ---
 
+### 4.14 Multi-tenancy scope chain
+
+Per ARCH-CONSOLIDATION-ADDENDUM-2026-04-24 §Q2, form-builder child tables
+resolve tenancy through their parent via the declarative
+`tenantScopeStrategy()` method on each model. `OrganisationScope`'s
+resolver walks parents recursively (max 3 hops) until it reaches a
+column-based strategy (direct `organisation_id`, or a legacy
+`$organisationScopeColumn` bridge like `event_id` or
+`festival_section_id`).
+
+The chains for the nine form-builder child models are:
+
+| Model | Strategy | Hops to org |
+|-------|----------|-------------|
+| `FormSubmission` | `column: organisation_id` (denormalized, §4.3) | 0 |
+| `FormSchema` | `column: organisation_id` (existing) | 0 |
+| `FormSchemaSection` | `via: FormSchema, fk: form_schema_id` | 1 |
+| `FormField` | `via: FormSchema, fk: form_schema_id` | 1 |
+| `FormSchemaWebhook` | `via: FormSchema, fk: form_schema_id` | 1 |
+| `FormSubmissionSectionStatus` | `via: FormSubmission, fk: form_submission_id` | 1 |
+| `FormSubmissionDelegation` | `via: FormSubmission, fk: form_submission_id` | 1 |
+| `FormWebhookDelivery` | `via: FormSubmission, fk: form_submission_id` | 1 |
+| `FormValue` | `via: FormSubmission, fk: form_submission_id` | 1 |
+| `FormValueOption` | `via: FormValue, fk: form_value_id` → FormSubmission → `organisation_id` | 2 |
+
+The same work package extended scope coverage to five event-data models
+outside the form-builder domain:
+
+| Model | Strategy | Notes |
+|-------|----------|-------|
+| `ShiftAssignment` | `via: Shift, fk: shift_id` | Shift uses legacy `festival_section_id` bridge |
+| `ShiftWaitlist` | `via: Shift, fk: shift_id` | — |
+| `VolunteerAvailability` | `via: TimeSlot, fk: time_slot_id` | TimeSlot uses legacy `event_id` bridge |
+| `PersonSectionPreference` | `via: FestivalSection, fk: festival_section_id` | FestivalSection uses legacy `event_id` bridge |
+| `PersonIdentityMatch` | `via: Person, fk: person_id` | Person uses legacy `event_id` bridge |
+
+Callers that need cross-org queries (public form endpoints, admin
+dashboards, anonymisation retention jobs) must use
+`->withoutGlobalScope(OrganisationScope::class)` explicitly — see
+`PublicFormSchemaResource::toArray()` for the canonical pattern on
+`loadMissing(['fields' => fn ($q) => $q->withoutGlobalScope(...)])`.
+
+---
+
 ## 5. FormFieldType catalogue
 
 ### 5.1 Built-in types