refactor(departments-edit): migrate to actionEditContext (step 2)

Pilot migration of pages/admin/departments/edit($id).php onto the
actionEditContext aggregator introduced in step 1. The CONTEXT-stage
vorspiel (lookup → authorize → tenant-scope → can_view_page → viewAuth)
collapses into a single declarative call; the POST branch (CSRF →
SUBMIT-authorize → can_update gate → service call → PRG) stays
callsite-specific as planned.

Three deliberate touches beyond a 1:1 lift:

* Additive aggregator extension: actionEditContext gains an optional
  notFoundFlashScopeKey arg so the dedup scope-key 'department_not_found'
  is preserved without widening the frozen actionResolveModelOrFail
  building-block signature. Pattern is documented as the
  forward-compatibility mechanism for future cluster migrations.
* t() consistency: the not-found message now flows through t() via the
  aggregator. To avoid a partial-translation mix, Flash::success calls
  for 'Department updated' (×2) are also wrapped — German users now see
  fully translated messages instead of a German/English mix.
* Defensive scope consumption: the action now consults
  $tenantScope['scope'] before falling through to the strict-mode
  fallback. The Departments policy never emits can_manage_all_tenants
  today (so behavior is identical), but the action is now resilient to
  future policies that might.

New ActionContextCsrfPairingContractTest enforces actionRequireCsrf()
before any POST body access for actions that use the aggregators —
preventing CSRF-pairing regressions during the cluster-wide rollout
(step 3). The step-1 testNoProductionCallSitesYet guard is removed,
since departments-edit is now the first legitimate caller; the new
pairing test takes over its protective role with a more substantive
guarantee.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/Support/Helpers/ActionContextHelperTest.php

@@ -335,6 +335,83 @@ class ActionContextHelperTest extends TestCase
         $this->assertStringContainsString('admin/users', $this->capturedRedirect());
     }
 
+    public function testEditContextWithFlashScopeKeyOverride(): void
+    {
+        // Departments-Edit pilot use-case: aggregator must emit a flash with
+        // the caller-specific scope-key ('department_not_found') instead of
+        // the building-block default ('not_found') when notFoundFlashScopeKey
+        // is provided. Required for Step 2 behavior identity (Run
+        // 2026-04-25-action-context-rollout-step2-departments).
+        $this->stubAuthorizationService(static fn (): AuthorizationDecision => AuthorizationDecision::allow([
+            'capabilities' => ['can_view_page' => true],
+        ]));
+        $_SESSION['flash_messages'] = [];
+
+        actionEditContext([
+            'finder' => static fn (): mixed => null,
+            'rawId' => 'missing',
+            'notFoundFlashKey' => 'Department not found',
+            'notFoundRedirectPath' => 'admin/departments',
+            'notFoundFlashScopeKey' => 'department_not_found',
+            'abilityKey' => 'ABILITY_DEPARTMENTS_EDIT_CONTEXT',
+            'context' => [],
+            'viewAuthFlags' => [],
+        ]);
+
+        $this->assertStringContainsString('admin/departments', $this->capturedRedirect());
+
+        $entry = $this->findFlashEntryByKey('department_not_found');
+        $this->assertNotNull($entry, "Expected flash with key 'department_not_found' to be set by aggregator override.");
+        $this->assertSame('error', $entry['type'] ?? null);
+        $this->assertSame('admin/departments', $entry['scope'] ?? null);
+    }
+
+    public function testEditContextWithoutFlashScopeKeyKeepsBuildingBlockDefault(): void
+    {
+        // Without notFoundFlashScopeKey, the aggregator delegates to
+        // actionResolveModelOrFail which hardcodes scope-key 'not_found'.
+        // This test pins the default-path behavior so a future addition
+        // doesn't accidentally widen building-block semantics.
+        $this->stubAuthorizationService(static fn (): AuthorizationDecision => AuthorizationDecision::allow([
+            'capabilities' => ['can_view_page' => true],
+        ]));
+        $_SESSION['flash_messages'] = [];
+
+        actionEditContext([
+            'finder' => static fn (): mixed => null,
+            'rawId' => 'missing',
+            'notFoundFlashKey' => 'action.context.model_not_found',
+            'notFoundRedirectPath' => 'admin/users',
+            'abilityKey' => 'ABILITY_USERS_EDIT_CONTEXT',
+            'context' => [],
+            'viewAuthFlags' => [],
+        ]);
+
+        $entry = $this->findFlashEntryByKey('not_found');
+        $this->assertNotNull($entry, "Expected default building-block scope-key 'not_found' when notFoundFlashScopeKey is absent.");
+    }
+
+    /**
+     * @return array<string, mixed>|null
+     */
+    private function findFlashEntryByKey(string $key): ?array
+    {
+        /** @var mixed $rawMessages */
+        $rawMessages = $_SESSION['flash_messages'] ?? [];
+        if (!is_array($rawMessages)) {
+            return null;
+        }
+        foreach ($rawMessages as $entry) {
+            if (!is_array($entry)) {
+                continue;
+            }
+            if (($entry['key'] ?? null) === $key) {
+                return $entry;
+            }
+        }
+        return null;
+    }
+
     /* ----------------------------------------------------------------
      * Aggregator: actionCreateContext
      * ---------------------------------------------------------------- */