Review, publish, preview and undo changes through the API

Revisions now call publishing only what publishes: a project's status is
whether the work is active, and a service is published by its flag.

The fake identity server answers by token, so a test can sign in a second
person.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/FakesPireon.php

@@ -15,6 +15,14 @@ trait FakesPireon
 {
     protected string $pireonServer = 'https://oauth.pireon.test';
 
+    /**
+     * Identity payloads by bearer token, for every user a test has signed in
+     * through the API.
+     *
+     * @var array<string, array<string, mixed>>
+     */
+    protected array $pireonIdentities = [];
+
     /**
      * @param  array<string, mixed>  $identity  Overrides for the GET /api/user payload.
      * @param  array<string, mixed>  $token  Overrides for the POST /oauth/token payload.
@@ -74,20 +82,39 @@ trait FakesPireon
      */
     protected function apiHeadersFor(User $user): array
     {
-        Http::fake([
-            "{$this->pireonServer}/api/user" => Http::response([
-                'id' => $user->oauth_id,
-                'name' => $user->name,
-                'email' => $user->email,
-                'is_active' => true,
-                'roles' => ['user'],
-                'app_roles' => [],
-                'approved_at' => '2026-01-01T00:00:00+00:00',
-            ]),
-        ]);
+        $token = 'token-for-'.$user->oauth_id;
+
+        // Answered by token rather than with one fixed payload: the first
+        // `Http::fake` for a URL wins, so a test that signs in a second person
+        // would otherwise keep being told it was the first.
+        if ($this->pireonIdentities === []) {
+            Http::fake([
+                "{$this->pireonServer}/api/user" => function ($request) {
+                    $presented = str_replace('Bearer ', '', $request->header('Authorization')[0] ?? '');
+
+                    return isset($this->pireonIdentities[$presented])
+                        ? Http::response($this->pireonIdentities[$presented])
+                        : Http::response(['message' => 'Unauthenticated.'], 401);
+                },
+            ]);
+        }
+
+        $this->pireonIdentities[$token] = [
+            'id' => $user->oauth_id,
+            'name' => $user->name,
+            'email' => $user->email,
+            'is_active' => true,
+            'roles' => ['user'],
+            'app_roles' => [],
+            'approved_at' => '2026-01-01T00:00:00+00:00',
+        ];
+
+        // The guard remembers whoever it resolved last; a test that switches
+        // people halfway has to make it ask again.
+        $this->app['auth']->forgetGuards();
 
         return [
-            'Authorization' => 'Bearer token-for-'.$user->oauth_id,
+            'Authorization' => 'Bearer '.$token,
             'Accept' => 'application/json',
         ];
     }