feat(certificates): required form fields as their own list

[rpgmem]

Closes #1741

Problem

One list, Settings → Certificates → Required Certificate Tags, did two jobs. It named the tags a certificate layout must print, and it named the form fields a form must have. A field derived from a tag had no label and no type of its own: the builder locked its name but left its type free, so a required email could be saved as Text. The defaults also could not express "{{schedule}} in the layout, but no field for it".

Change

• Settings → Certificates now has two cards.
  • Required Certificate Tags (the layout). Default {{auth_code}}, {{name}}, {{cpf_rf}}, {{schedule}}. {{auth_code}} stays forced. {{schedule}} is asked only of a form with an Event Schedule (FormEditorSaveValidator::layout_required_tags()).
  • Required Form Fields, a new table of field name, label and type. Types are limited to text, textarea, email, number and date. Rows can be added and removed, except the Email row, which is locked and also forced by the reader. Default rows are name (Text), cpf_rf (Text) and email (Email). An administrator can remove name or cpf_rf.
• Form editor
  • A new form is seeded from the table.
  • A required field keeps its name, type and required flag; only the label is editable. The type is posted through a hidden input next to a disabled select.
  • The save handler forces the configured type.
  • A form missing required fields shows a notice with an "Add the required fields" button, which adds them as locked rows (ffc-admin-field-builder.js).
• Compatibility
  • An install that never saved the table derives it from its old tag list: each tag the plugin does not generate itself becomes a Text field.
  • A tag list saved before this change never named {{schedule}}, so the reader keeps the schedule check until the tab is saved again.
• required_form_fields is added to the undeclared-settings baseline, like required_certificate_tags. A declared default would be wrong here: when the key is absent, the reader takes the legacy path above.
• New script ffc-certificate-settings.js for adding and removing table rows. A small CSS rule keeps the table inside the card.

Tests

• PHPUnit:
  • SettingsReaderTest: default table, saved table with an invalid type or name, emptied table still requires Email, legacy derivation, legacy {{schedule}}.
  • RequiredCertificateFieldsTest: an administrator can drop name/cpf_rf but not Email, required_field(), {{schedule}} only with an Event Schedule.
  • SettingsSaveHandlerTest: table sanitising covers a duplicate name, a generated tag, a hyphen, an unknown type and an empty name; a save without the table leaves it alone.
  • FormEditorSaveHandlerTest: the type is forced, and missing fields are reported by name.
  • FormEditorBuilderMetaboxTest: type locked, missing notice and button, a complete form shows no notice, a new form is seeded.
• Vitest: adding fields, which lock the row and drop the notice, and a payload that cannot be read; adding and removing table rows, where Email cannot be removed. All 2046 tests pass.
• e2e on a local WordPress:
  • removed cpf_rf and added a course (Date) field, then saved and reloaded: both changes persisted;
  • a new form was seeded with the configured types;
  • an existing form offered the missing fields and added them locked, with no JS errors.
• PHPStan, row shapes (level 9), PHPCS, ESLint, Stylelint, and the i18n, CSS and docs guards all pass locally.

Risk

There is no migration. The legacy path keeps existing installs behaving as before until the tab is saved. A required field saved with the wrong type is corrected on its form's next save.

Checklist

• Base is develop; no version bump
• CHANGELOG.md — one bullet under [Unreleased] → Changed, citing Certificates: separate the tags a layout must carry from the fields a form must have #1741, ≤300 characters
• Documentation topics updated (feature-certificates.php, forms-dynamic-fields.php)
• Strings in the .pot and .po, catalogues recompiled
• Minified assets rebuilt
• Fast checks run locally; full suite running before ready

🤖 Generated with Claude Code

https://claude.ai/code/session_018srx5hc431EYmG4MHUr2KA

---

Generated by Claude Code