feat(portal): citizen create actions — reactions + budget proposals

[rubenvdlinde]

Summary

• Extends the portal-citizen-create-actions OpenSpec change: the citizen ADR-046 manifest gains two type: create actions — createReaction (consultation-reaction) and createBudgetProposal (budget-proposal) — closing the write-IDOR/read-only gap left by portal-contribution.
• Scope is stamped server-side via portaliq's scopeField mechanism (submitterId/submitter), never client-writable; the intake state (moderationStatus: 'pending' / status: 'submitted') is stamped via defaults, also never client-writable. minTrust stays low (account-less participation).
• Finding at apply-time (tasks.md T01): portaliq's real create receiver (ContributionController::create() + PortalObjectWriter) uses scopeField + defaults, not the brief's set shorthand, and does not enforce a declared parentConstraint. Closed with a new PortalCreateOpenParentGuardListener on OpenRegister's ObjectCreatingEvent — fail-closed reject (via stopPropagation() → HookStoppedException, before the row is persisted) when the parent PublicConsultation isn't status: open (createReaction) or the parent ParticipatoryBudget isn't status: submission (createBudgetProposal).
• OpenSpec change archived to openspec/specs/portal-citizen-create-actions/spec.md; openspec validate --specs --strict green (97/97).

Test plan

• tests/Unit/Portal/PortalContributionProviderTest.php (extended, 21 tests total): manifest shape, exact whitelists/scopeField/defaults/parentConstraint, write-IDOR/staff-field invariant, register-drift pin against decidesk_register.json.
• tests/Unit/Listener/PortalCreateOpenParentGuardListenerTest.php (new, 9 tests): open/closed consultation, submission/draft budget round, both write-path shapes (scalar field vs relations array), missing parent, unrelated schema, non-ObjectCreatingEvent, infrastructure failure fails closed (deliberate contrast with SubmissionDeadlineListener's fail-soft business-rule posture — this is a security invariant).
• Full unit suite in nextcloud:34.0.0-apache container: 790/790 pass except 1 pre-existing, unrelated failure (RegisterJsonTest::testGovernanceBodySchema, confirmed present on unmodified origin/development before this PR).
• phpcs (lib/ scope): clean on all touched files (also fixed one pre-existing full-stop nit in Application.php encountered while editing it).
• phpmd: clean on all touched/new files (refactored citizenContribution()/handle()/resolveSchemaSlug() to stay under the method-length/cyclomatic-complexity thresholds).
• phpstan: 0 errors on touched/new files (1 pre-existing, unrelated error remains elsewhere in Application.php; project has ~66 pre-existing errors overall, masked today by composer test:all's || echo skip fallback — out of scope for this PR).
• psalm: clean (exit 0, no reported errors).
• Hydra gates (--scope-to-diff): 38/39 green; spec-anchor-existence fails on 52 pre-existing, unrelated broken @spec anchors already in Application.php from older archived changes (none touch this PR's new code or new @spec tags) — filed as a known systemic issue, not addressed here (out of scope).
• No Playwright/e2e added — portaliq owns the entire portal UI/SPA (out of scope per design.md); covered by PHPUnit only, matching the archived spec's @e2e exclude scenarios.