Review, publish, preview and undo changes through the API

Revisions now call publishing only what publishes: a project's status is
whether the work is active, and a service is published by its flag.

The fake identity server answers by token, so a test can sign in a second
person.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/Http/Resources/ReviewCommentResource.php

@@ -0,0 +1,32 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Resources;
+
+use App\Models\ReviewComment;
+use Illuminate\Http\Request;
+use Illuminate\Http\Resources\Json\JsonResource;
+
+/**
+ * @mixin ReviewComment
+ */
+class ReviewCommentResource extends JsonResource
+{
+    /**
+     * @return array<string, mixed>
+     */
+    public function toArray(Request $request): array
+    {
+        return [
+            'id' => $this->id,
+            'event' => $this->event->value,
+            'body' => $this->body,
+            'author' => [
+                'id' => $this->user_id,
+                'name' => $this->user?->name ?? $this->user_name,
+            ],
+            'created_at' => $this->created_at?->toIso8601String(),
+        ];
+    }
+}