Add firm metadata and a publication gate

[swilla]

Details

Library items can now carry the day-one metadata a manifest supplies, and imports stay out of search until a gatekeeper publishes them.

What changed

• Items store firm_path, library_area (folder / Library area), committee, and project_tags.
• filament-library:import reads a CSV manifest and creates each row as pending or draft. A published value in the file is ignored.
• Search All, the main Library list, and Public Library only include published items. Draft, pending, and rejected items stay out of search.
• A gatekeeper publishes, rejects, or returns an item from the Gatekeeper Queue or with filament-library:review. Publishing fires LibraryItemPublished. Rejecting fires LibraryItemRejected.
• Ordinary creates stay published unless publication.new_items_require_approval is turned on. publication.committees can restrict import committee names (leave it empty to allow any name).

Tests

vendor/bin/pest — 43 passed. PHPStan reports no errors.

Next slice

Wire this into s9-intranet-web: browse published items, Copy Path from firm_path, and a Design / Technical gatekeeper queue that calls publish and reject. Ask indexing should listen for LibraryItemPublished so drafts are never embedded. Leave MCP, spend caps, OCR, native CAD/BIM, directives, Electron open-in-Explorer, and Entra SSO for later.