feat(form-builder): FormFieldConditionalLogicService + cycle detection + legacy backfill + snapshot

WS-5c commit 2 of 4 — the service layer, backfill migration, and
read-path switch. Per addendum Q3, conditional_logic applies to
FormField only — no library mirror and no copyLogic on
FormFieldService::insertFromLibrary.

FormFieldConditionalLogicService owns every write:
  - logicFor(field): depth-limited eager-load of the tree
  - replaceLogic(field, tree): transactional structure + operator +
    field_slug validation + cycle check + activity-log emit
    (field.conditional_logic_replaced)
  - toJsonShape(root): reconstructs the canonical ARCH §8
    `{show_when: {...}}` shape — single source of truth for the
    snapshot writer + API resources
  - assertSpecsValid(tree): public boundary guard for the FormRequest
    strict validator (WS-5c commit 3 wires this up)
  - assertNoCycles(field, tree): contract preserved from
    FormFieldService::assertNoConditionalCycle, implementation now
    reads the relational adjacency.

Backfill migration translates pre-WS-5c conditional_logic JSON to
rows. Strict dispatch: unknown operators / unknown top-level keys /
malformed groups FAIL the migration — Phase A seed-scan confirmed
the catalogue parity, so any drift is a data bug to fix at source,
not silently absorb. Rollback rebuilds canonical JSON and clears
the relational tree.

FormFieldService.create/update route `conditional_logic` through
the new service (matching the extract-and-delegate pattern from
WS-5a bindings and WS-5b validation rules). Snapshot writer + both
resources (FormFieldResource, PublicFormSchemaResource) read via
`toJsonShape(rootConditionalLogicGroup())` — byte-for-byte parity
with the pre-WS-5c JSON contract.

InvalidConditionalLogicSpecException handled in FormFieldController
as 422, same as FrozenSchemaException / CyclicDependencyException.

Tests: 20 new under tests/Feature/FormBuilder/ConditionalLogic/
(service, cycle detection, backfill forward+rollback+failure cases,
snapshot + resource parity). FormFieldApiTest cyclic rejection test
rewritten to use the new factory state. Rollback step counts in
WS-5a/b migration tests bumped +1 for the new backfill migration.
Baseline 1122 → 1142 green (3032 → 3085 assertions).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

api/tests/Feature/FormBuilder/FormFieldApiTest.php

@@ -110,14 +110,23 @@ final class FormFieldApiTest extends TestCase
     {
         Sanctum::actingAs($this->admin);
 
-        // field A depends on field B
-        $fieldA = FormField::factory()->create([
-            'form_schema_id' => $this->schema->id,
-            'slug' => 'a',
-            'conditional_logic' => ['show_when' => ['all' => [['field_slug' => 'b', 'operator' => 'equals', 'value' => true]]]],
-        ]);
+        // field A depends on field B — relational rows via factory helper
+        // (WS-5c commit 2 moved cycle detection to the relational-backed
+        // `FormFieldConditionalLogicService::assertNoCycles`).
+        $fieldA = FormField::factory()
+            ->withConditionalLogic([
+                'operator' => 'all',
+                'children' => [
+                    ['field_slug' => 'b', 'operator' => 'equals', 'value' => true],
+                ],
+            ])
+            ->create([
+                'form_schema_id' => $this->schema->id,
+                'slug' => 'a',
+            ]);
         $fieldB = FormField::factory()->create(['form_schema_id' => $this->schema->id, 'slug' => 'b']);
 
+        // Updating fieldB to depend on fieldA would close the A → B → A loop.
         $response = $this->putJson(
             "/api/v1/organisations/{$this->org->id}/forms/schemas/{$this->schema->id}/fields/{$fieldB->id}",
             ['conditional_logic' => ['show_when' => ['all' => [['field_slug' => 'a', 'operator' => 'equals', 'value' => true]]]]],