feat(13-01): add the prohibited rule and dated-download and notification masks

- lagoon.ValidateRequest supports Laravel 9 prohibited (!required, not
  implicit); with no catalog line its message is validation.prohibited
- tide compares Content-Disposition with real calendar dates masked on both
  sides; a different name, an invalid date or a one-sided date still diffs
- tide.NormalizePublications masks a Carbon +00:00 $.data.payload.created_at
  and an uncaptured positive integer $.data.payload.id as {{id}}
- the album-date test's outside-album sibling moves off payload.created_at,
  which now has its own mask
- READMEs and docs describe the rule and both masks

modules/tide/multipart_test.go

@@ -265,7 +265,7 @@ func TestNormalizePublicationAlbumDates(t *testing.T) {
 	pub := func(created, updated string) []Publication {
 		return []Publication{{Method: "POST", Path: "/api/publish", Body: json.RawMessage(
 			`{"channel":"c","data":{"payload":{"album":{"name":"x","created_at":"` + created + `","updated_at":"` + updated +
-				`","market_price_checked_at":null,"photos":[{"created_at":"` + created + `"}]},"created_at":"2026-01-01T00:00:00+00:00"}}}`)}}
+				`","market_price_checked_at":null,"photos":[{"created_at":"` + created + `"}]},"published_at":"2026-01-01T00:00:00+00:00"}}}`)}}
 	}
 	a, err := NormalizePublications(pub("2026-09-30T11:21:55+00:00", "2026-09-30T11:21:56+00:00"), store)
 	if err != nil {
@@ -281,8 +281,10 @@ func TestNormalizePublicationAlbumDates(t *testing.T) {
 	if !strings.Contains(string(a[0].Body), `"updated_at":"{{datetime}}"`) || !strings.Contains(string(a[0].Body), `"market_price_checked_at":null`) {
 		t.Fatalf("album dates not masked: %s", a[0].Body)
 	}
-	// Only the album subtree is masked; a payload date outside it stays.
-	if !strings.Contains(string(a[0].Body), `},"created_at":"2026-01-01T00:00:00+00:00"`) {
+	// Only the album subtree is masked; a payload date outside it stays
+	// ($.data.payload.created_at itself is the notification row's date and
+	// has its own mask, see TestNormalizeNotificationPublication).
+	if !strings.Contains(string(a[0].Body), `},"published_at":"2026-01-01T00:00:00+00:00"`) {
 		t.Fatalf("over-normalised: %s", a[0].Body)
 	}
 	// A Z-suffixed album date keeps its value, so a format change is a diff.