Duplicate a question through the API

[PhilReinking]

Adds POST /api/blocks/{block}/duplicate for the editor's question menu. It copies a question's text, type, settings, answers and Required, not its rules or Identifier, and puts the copy right after the original.

Fixes BITS-275

• One transaction: if any part fails, the form stays as it was. It locks the form first, so duplicates at the same time wait.
• The copy has no Identifier (title): prefill links and webhook names use it, so a shared one clashes.
• Renumbers the form's blocks from 0, since older forms can have gaps or two blocks on one position (adding after a delete).
• A question in a group stays in that group. A group itself gets 422: copying a whole group isn't in the ticket.
• Returns the copy (201) in the shape of the other block endpoints, with interactions and empty logics.

Tested: full PHP suite on MariaDB and SQLite. New tests fail on main (no route), the rollback test fails without the transaction. 16 duplicates at once on MariaDB: 21 questions on 15 positions before the lock, 21 on 21 after. Scribe lists the endpoint.

Not tested: no UI uses it yet. The frontend adds the menu entry.

🤖 Generated with Claude Code

[PhilReinking]

OK at 5a02fb5, CI green.

The new tests fail on main (no route), and the rollback test fails without the transaction. Beyond that: the response equals the block in the block list, nested options, turned-off answers and file limits copy over, and existing submissions stay on the original. A guest gets 401, a block of a trashed form 403. The generated API docs list the endpoint.

[PhilReinking]

OK at a26b17b, CI green. Both new tests fail on 5a02fb5. MariaDB, 4 workers, 16 duplicates at once: with the lock 21 questions on 21 positions in 3 of 3 rounds; without it, two on one position in round 1. The child's own position only fixes the test's tie, the import works in any order. A copy without Identifier breaks nothing: new questions start that way, and webhooks fall back to the uuid.

[PhilReinking]

Should: SQLite, the Docker image's default, ignores lockForUpdate, and on PHP 8.3 the transaction starts deferred, so a read that turns into a write fails at once. 16 duplicates at once gave 5 to 9 errors 500 "database is locked" per round (positions stayed right). A write first waits on both databases: 16 of 16, 21 on 21, on SQLite and MariaDB. It also marks the form as edited. Tested together with the test change below.

Suggested change

	// duplicates at the same time wait here, else they renumber over each other or deadlock
	$this->form()->lockForUpdate()->first();
	// duplicates at the same time wait here, else they renumber over each other or deadlock.
	// A write, not lockForUpdate: SQLite ignores that and fails a read that turns into a write
	$this->form()->touch();

[PhilReinking]

With the write first, this check runs on SQLite too. Passes on MariaDB and SQLite.

Suggested change

	expect(DB::getQueryLog()[0]['query'])->toStartWith('select * from `forms` where `forms`.`id` = ?')->toEndWith('for update');
	})->skip(fn () => DB::getDriverName() === 'sqlite', 'SQLite locks the whole database on write');
	expect(DB::getQueryLog()[0]['query'])->toMatch('/^update [`"]forms[`"] set /');
	});

[PhilReinking]

OK at b7105c3, CI green. The change since a26b17b is the write-first lock and the test without the SQLite skip. 16 duplicates at once, 4 workers: 21 questions on 21 positions and no errors, on MariaDB in 3 rounds and on SQLite in 2.