…, fix CI resolution (#299)

* fix(mails): require authentication and mail permissions on preview and attachment routes

The preview and attachment download routes were registered via Panel::routes(),
which Filament invokes outside the auth middleware group, so both were reachable
unauthenticated. The attachment route also ignored its {mail} segment, so any
attachment id resolved under any mail id.

Access control is now attached inside Mails::routes() itself, so it holds
regardless of how a consumer registers the routes, and attachments resolve
through $mail->attachments().

Fixes #83

* fix(mails): restore PHPStan dependencies and handle all EventType cases

The Filament v4 upgrade dropped larastan and the phpstan packages from
require-dev but left phpstan.neon.dist, the baseline, the analyse script and the
workflow in place, so composer analyse has been failing with exit 127.

With PHPStan running again it found three genuine match.unhandled errors: the
badge colour closures handle 8 of EventType's 29 cases with no default arm, so
any other event type threw UnhandledMatchError and 500'd the events pages.

* ci(mails): pin COMPOSER_ROOT_VERSION so branch builds resolve laravel-mails

This package requires backstage/laravel-mails at self.version. Composer derives
the root version from git, and on a shallow CI checkout of a feature branch that
becomes dev-<branch-name>, which does not exist in laravel-mails, so dependency
resolution failed on every PR including dependabot's.

Also scopes the PHPStan workflow to main and pull requests; it previously ran on
every push including tags.

* test(mails): cover the preview and attachment routes under tenancy

The download controller previously branched on argument count to strip a
{tenant} segment; that branch was removed in favour of named route parameters
and nothing exercised it. These tests register the routes via
authenticatedTenantRoutes() on a panel with a tenant and assert the mail and
attachment parameters still resolve, and that attachments stay scoped to their
mail behind the tenant segment.

* test: assert site default column state instead of Filament icon CSS classes

ListSitesTest asserted on the literal class string emitted by Filament's icon
helper. generate_icon_html() switched from Laravel's ComponentAttributeBag to
Filament's own subclass in 5.7, which orders classes differently, so the
assertion broke as soon as CI's composer update crossed 5.6 -> 5.7. This is why
5.x has been red since 2026-07-18 while local checkouts on 5.6.7 stayed green.

Asserts the column state via the table testing API instead, which is stable
across both versions.

The mail preview threw `Route [filament.{panel-id}.mails.preview] not
defined` because the package still required consumers to wire up
`Mails::routes()` in their own PanelProvider. Register them from
`MailsPlugin::register()` instead, which runs while the panel is being
configured — before Filament reads the panel's route closures when
loading its route file.

Registering them from `boot()` would be too late: `Plugin::boot()` runs
from the `SetUpPanel` middleware, after routing has already matched, so
the routes would never resolve and would fall outside the
`filament.{panel-id}.` name group.

Only one variant is registered per panel. Registering both
`authenticatedRoutes()` and `authenticatedTenantRoutes()` unconditionally
defines the routes twice under the same names, and the tenant-less
variant wins the name lookup — so a tenancy panel would generate
`/tenancy/mails/1/preview?tenant=1` instead of
`/tenancy/1/mails/1/preview`, losing the tenant segment.

The test panel providers no longer register the routes by hand, so the
existing security and tenancy suites now cover the plugin's own
registration.

Refs #77

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>