feat(form-builder): retry/resolve/dismiss API endpoints + dual-route auth (WS-6)

Two route groups: /api/v1/admin/form-failures (super_admin platform) and
/api/v1/organisations/{organisation}/form-failures (org_admin scoped).
Same controller, policy authorises via FK chain (RFC V3). Cross-tenant
access returns 404 not 403 to prevent enumeration.

Resolve takes optional note; Dismiss requires DismissalReasonType
enum with conditional note (mandatory for 'other'). Both via
FormRequest validation with explicit i18n message keys.

Implementation note: Laravel implicit model binding for nested-namespace
ULID models doesn't pick up reliably across nested route groups. Using
manual resolveFailure() helper that loads withoutGlobalScopes() (so
cross-tenant access still reaches the policy, which translates denied →
404 per V3). Policy explicitly checks soft-delete via deleted_at since
withoutGlobalScopes bypasses SoftDeletes too. Policy registered
explicitly in AppServiceProvider — auto-discovery doesn't reliably
resolve App\Models\FormBuilder\* → App\Policies\FormBuilder\*.

NOT: admin UI (session 3). Not: public form routes (no API contract
notification needed).

Refs: RFC-WS-6.md §3 (Q5), §4 (V2, V3)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

api/app/Providers/AppServiceProvider.php

@@ -64,6 +64,7 @@ use App\Observers\UserObserver;
 use Illuminate\Auth\Notifications\ResetPassword;
 use Illuminate\Database\Eloquent\Relations\Relation;
 use Illuminate\Support\ServiceProvider;
+use Illuminate\Support\Facades\Gate;
 use Spatie\Activitylog\Models\Activity;
 
 class AppServiceProvider extends ServiceProvider
@@ -120,6 +121,16 @@ class AppServiceProvider extends ServiceProvider
     {
         $this->registerMorphMap();
 
+        // RFC-WS-6 V3 — explicit policy registration. Laravel's auto-discovery
+        // doesn't reliably resolve nested-namespace models like
+        // App\Models\FormBuilder\FormSubmissionActionFailure to
+        // App\Policies\FormBuilder\FormSubmissionActionFailurePolicy.
+        Gate::policy(
+            \App\Models\FormBuilder\FormSubmissionActionFailure::class,
+            \App\Policies\FormBuilder\FormSubmissionActionFailurePolicy::class,
+        );
+
+
         Person::observe(PersonObserver::class);
         User::observe(UserObserver::class);
         FormValue::observe(FormValueObserver::class);