Review, publish, preview and undo changes through the API

Revisions now call publishing only what publishes: a project's status is
whether the work is active, and a service is published by its flag.

The fake identity server answers by token, so a test can sign in a second
person.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/Feature/Api/AdminApiContractTest.php

@@ -114,6 +114,7 @@ class AdminApiContractTest extends TestCase
         $repository = Repository::factory()->create();
         Setting::set(Maintenance::KEY, ['enabled' => false]);
         $media = Media::factory()->create();
+        $page->comment('Primera nota', $this->caller);
 
         // One request, one documented path — the URL a real caller hits and
         // the path key that describes it, side by side rather than derived
@@ -153,6 +154,8 @@ class AdminApiContractTest extends TestCase
             'maintenance' => ['/v1/maintenance', '/v1/maintenance'],
             'media' => ['/v1/media', '/v1/media'],
             'medium' => ["/v1/media/{$media->id}", '/v1/media/{media}'],
+            'revisions' => ["/v1/projects/{$project->id}/revisions", '/v1/projects/{project}/revisions'],
+            'review thread' => ["/v1/pages/{$page->id}/reviews", '/v1/pages/{page}/reviews'],
             'users' => ['/v1/users', '/v1/users'],
             'user' => ["/v1/users/{$this->caller->id}", '/v1/users/{user}'],
             'me' => ['/v1/me', '/v1/me'],