refactor: modernize codebase

[vitormattos]

This PR adds these improvements:

• better Telegram message templates, including placeholders for the survey question, answer, and raw value;
• safer message rendering for both HTML and plain text modes;
• a more reliable flow to save survey-specific plugin settings.

To support these changes, the codebase was updated and expanded with unit tests, code quality and static analysis checks (PHP CS Fixer and Psalm), API integration tests with Behat, and screenshot validation tests with Playwright.

I made smoke tests and the plugin follow working fine, sending the message to Telegram and the new fields also worked fine.

[YvesCesar]

@vitormattos

fiz um experimento com Opus 5 para revisão deste PR. Pode avaliar se faz sentido os achados?

Revisão do PR "refactor: modernize codebase" do Opus 5

[YvesCesar]

Changes based on automated reviews.

Permission check on saveSurveyPluginSettings (security)

Commit 5af0eb5

The endpoint saved per-survey plugin settings requiring only survey/read, whereas the native "Simple plugin settings" flow requires surveysettings/update. A read-only collaborator could overwrite ChatId/AuthToken and redirect notifications.

• Added the same gate core uses: Permission::model()->hasSurveyPermission($surveyId, 'surveysettings', 'update'), returning 403 when missing.
• Kept the multi-plugin dispatch (the save workaround reuses the #plugins form, matching native behavior); restricting it to static::$name would drop other plugins' settings on the same page.
• Added test coverage for the denial path.

Validated: survey/read only → 403 {"success":false}, nothing written; surveysettings/update → 200 {"success":true}.

Production install broken by post-install-cmd (build)

Commit a90b48b

The hook ran composer bin all install unconditionally, which:

• made composer install --no-dev abort (Command "bin" is not defined);

• on a plain composer install, pulled psalm ^6 / phpunit ^11 / php-cs-fixer ^3 into the host, failing on PHP < 8.1/8.2 (within the range declared in config.xml).

• Removed the post-install-cmd/post-update-cmd hooks; tools:install stays available on demand.

• phpunit/psalm/lint-php-cs workflows now run composer run tools:install explicitly.

• README.md: production uses composer install --no-dev; new Development section documents composer tools:install.

Validated: composer install --no-dev → exit 0; plain composer install no longer pulls the tools; composer tools:install installs everything.