press-releases: Publish-Rechte, Quota-Races & Slug vereinheitlichen

- Publish/Reject/Archive und changeStatus erzwingen konsistent
  press-releases:publish; changeStatus schloss die Lücke, über die das
  Status-Modal die Prüfung umging (Fix#1/H2).
- publish()/changeStatusFromAdmin sperren PM- und User-Zeile
  transaktional; QuotaExceededException wird in Admin-Publish und im
  Auto-Publish-Job abgefangen (Warnung statt 500 / bleibt in Review, Fix#3/M2).
- Slug-Erzeugung nur noch über HasUniqueSlug (generateUniqueSlug +
  saveWithUniqueSlugRetry), redundanter Controller-Helper entfernt (M3).
- API-/Legacy-Text wird vor der Persistenz sanitisiert (M6);
  Scheduler/Legacy-Tracking ignorieren soft-gelöschte PMs.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/Feature/Admin/AdminPressReleaseActionsTest.php

@@ -6,14 +6,79 @@ use App\Enums\PressReleaseStatus;
 use App\Jobs\ClassifyPressRelease;
 use App\Jobs\ScorePressRelease;
 use App\Models\AdminPreset;
+use App\Models\Company;
 use App\Models\KiAudit;
+use App\Models\Plan;
 use App\Models\PressRelease;
 use App\Models\User;
 use Database\Seeders\RolesAndPermissionsSeeder;
 use Illuminate\Support\Facades\Queue;
 use Livewire\Volt\Volt as LivewireVolt;
+use Spatie\Permission\Models\Role;
+use Spatie\Permission\PermissionRegistrar;
 use Tests\TestCase;
 
+test('changeStatus is forbidden without the publish permission', function () {
+    /** @var TestCase $this */
+    $this->seed(RolesAndPermissionsSeeder::class);
+
+    // Rolle mit Admin-Zugang (editor), aber ohne press-releases:publish.
+    Role::findByName('editor')->revokePermissionTo('press-releases:publish');
+    app(PermissionRegistrar::class)->forgetCachedPermissions();
+
+    $editor = User::factory()->create(['is_active' => true]);
+    $editor->assignRole('editor');
+    $this->actingAs($editor);
+
+    $pressRelease = PressRelease::factory()->create(['status' => PressReleaseStatus::Review->value]);
+
+    LivewireVolt::test('admin.press-releases.edit', ['id' => $pressRelease->id])
+        ->set('targetStatus', PressReleaseStatus::Published->value)
+        ->call('changeStatus')
+        ->assertForbidden();
+
+    expect($pressRelease->fresh()->status)->toBe(PressReleaseStatus::Review);
+});
+
+test('publishing without remaining quota shows a warning instead of a 500', function () {
+    /** @var TestCase $this */
+    $this->seed(RolesAndPermissionsSeeder::class);
+    // Kontingent greift erst mit dem Launch-Schalter.
+    config()->set('billing.enforce_booking', true);
+
+    $admin = User::factory()->create(['is_active' => true]);
+    $admin->assignRole('admin');
+
+    // Autor mit erschöpftem Plan-Kontingent und ohne Einzelkauf.
+    $author = User::factory()->create(['is_active' => true, 'press_release_quota_used_this_month' => 3]);
+    $author->assignRole('customer');
+    $plan = Plan::factory()->create([
+        'press_release_quota' => 3,
+        'stripe_price_id_monthly' => 'price_test_m_'.fake()->unique()->randomNumber(6),
+    ]);
+    subscribeUserToPlan($author, $plan);
+
+    $company = Company::factory()->presseecho()->create();
+    $author->companies()->attach($company->id, ['role' => 'owner']);
+    $pressRelease = PressRelease::factory()->create([
+        'user_id' => $author->id,
+        'company_id' => $company->id,
+        'portal' => $company->portal->value,
+        'status' => PressReleaseStatus::Review->value,
+    ]);
+
+    $this->actingAs($admin);
+
+    // Kein unbehandelter QuotaExceededException / kein 500: die Komponente fängt
+    // ihn ab und die PM bleibt in Review.
+    LivewireVolt::test('admin.press-releases.edit', ['id' => $pressRelease->id])
+        ->call('publish')
+        ->assertHasNoErrors()
+        ->assertOk();
+
+    expect($pressRelease->fresh()->status)->toBe(PressReleaseStatus::Review);
+});
+
 test('published press releases are tombstoned instead of soft deleted', function () {
     /** @var TestCase $this */
     $this->seed(RolesAndPermissionsSeeder::class);