Review, publish, preview and undo changes through the API

Revisions now call publishing only what publishes: a project's status is
whether the work is active, and a service is published by its flag.

The fake identity server answers by token, so a test can sign in a second
person.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

lang/en/rules.php

@@ -29,6 +29,16 @@ return [
         'cannot_publish' => 'You do not have permission to publish pages.',
     ],
 
+    'revisions' => [
+        'nothing_to_restore' => 'This revision has no changes to undo.',
+    ],
+
+    'reviews' => [
+        'not_requestable' => 'It is already awaiting review or already published.',
+        'not_a_reviewer' => 'That person cannot publish this, so they cannot review it.',
+        'not_awaiting' => 'It is not awaiting review.',
+    ],
+
     'settings' => [
         'read_only' => 'This setting is written by the application and cannot be edited by hand.',
     ],