feat(form-builder): add apply_status columns and action-failures table (WS-6)

- form_submissions: apply_status (nullable, NO default for legacy rows
  per RFC O1), apply_completed_at, indexed on (form_schema_id, apply_status)
  and (organisation_id, apply_status)
- form_submission_action_failures: ULID PK, FK to submission + binding,
  resolve/dismiss state separated (RFC V2), retention via parent
  cascade-delete
- Migration rehearsal test added (invokes down() directly because the new
  migrations land between WS-5a and WS-5b chronologically, not at the tail
  of the migration list)

Three pre-existing WS-5 backfill tests also bump their --step rollback
counts by +2 (FormFieldBindingMigrationTest, FormFieldConfigBackfillAndDropTest,
FormFieldValidationRuleBackfillTest) to account for the two new migrations
sitting in the chronological middle of the WS-5 stack — required to keep
those tests' pre-WS-5b rollback target reachable.

SCHEMA.md updated to v2.3.
Refs: RFC-WS-6.md §3 (Q4, Q5), §4 (V2), §5 (O1)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

api/database/migrations/2026_04_25_140000_extend_form_submissions_with_apply_status.php

@@ -0,0 +1,42 @@
+<?php
+
+declare(strict_types=1);
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+/**
+ * Adds apply_status (pending|completed|partial|failed) and apply_completed_at
+ * to form_submissions. apply_status is NULL for legacy rows by design (RFC O1):
+ * those submissions predate the binding pipeline and applying a 'pending'
+ * default would falsely classify them as awaiting work that will never run.
+ * Admin UI's "open work" filter excludes NULL rows explicitly.
+ */
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('form_submissions', function (Blueprint $table): void {
+            $table->string('apply_status', 20)
+                ->nullable()
+                ->after('identity_match_status');
+
+            $table->timestamp('apply_completed_at')
+                ->nullable()
+                ->after('apply_status');
+
+            $table->index(['form_schema_id', 'apply_status'], 'fs_schema_apply_status_idx');
+            $table->index(['organisation_id', 'apply_status'], 'fs_org_apply_status_idx');
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('form_submissions', function (Blueprint $table): void {
+            $table->dropIndex('fs_org_apply_status_idx');
+            $table->dropIndex('fs_schema_apply_status_idx');
+            $table->dropColumn(['apply_completed_at', 'apply_status']);
+        });
+    }
+};

api/database/migrations/2026_04_25_140100_create_form_submission_action_failures.php

@@ -0,0 +1,73 @@
+<?php
+
+declare(strict_types=1);
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+/**
+ * RFC-WS-6 Q5 — audit table for binding-pipeline failures. Tenant scope
+ * flows via form_submission_id → form_submissions.organisation_id (no
+ * denormalized organisation_id column here). Retention follows the parent
+ * submission via cascade-delete; no soft delete (audit table).
+ *
+ * Resolve and Dismiss are mutually exclusive workflows (RFC V2):
+ * resolved_at marks "succeeded via another path"; dismissed_at marks
+ * "will not be replayed" and requires a typed reason.
+ */
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::create('form_submission_action_failures', function (Blueprint $table): void {
+            $table->ulid('id')->primary();
+
+            $table->foreignUlid('form_submission_id')
+                ->constrained('form_submissions')
+                ->cascadeOnDelete();
+
+            $table->string('listener_class', 255);
+
+            $table->foreignUlid('binding_id')
+                ->nullable()
+                ->constrained('form_field_bindings')
+                ->nullOnDelete();
+
+            $table->timestamp('failed_at');
+            $table->string('exception_class', 255);
+            $table->text('exception_message');
+            $table->json('context');
+            $table->unsignedTinyInteger('retry_count')->default(0);
+
+            $table->timestamp('resolved_at')->nullable();
+            $table->foreignUlid('resolved_by_user_id')
+                ->nullable()
+                ->constrained('users')
+                ->nullOnDelete();
+            $table->text('resolved_note')->nullable();
+
+            $table->timestamp('dismissed_at')->nullable();
+            $table->foreignUlid('dismissed_by_user_id')
+                ->nullable()
+                ->constrained('users')
+                ->nullOnDelete();
+            $table->string('dismissed_reason_type', 40)->nullable();
+            $table->string('dismissed_reason_note', 500)->nullable();
+
+            $table->timestamps();
+
+            $table->index('form_submission_id', 'fsaf_submission_idx');
+            $table->index(['listener_class', 'failed_at'], 'fsaf_listener_failed_idx');
+            $table->index('resolved_at', 'fsaf_resolved_idx');
+            $table->index('dismissed_at', 'fsaf_dismissed_idx');
+            $table->index('binding_id', 'fsaf_binding_idx');
+            $table->index('dismissed_reason_type', 'fsaf_reason_type_idx');
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists('form_submission_action_failures');
+    }
+};