test(09-05): add failing tests for scoped record lifecycle

- Record routes must enforce permission before ids or bodies and return D-10 envelopes
- Create, update, and delete run Before and After hooks once inside the transaction
- Out-of-scope and missing records are indistinguishable, and hook failure rolls back

pact/capabilities.go

@@ -207,6 +207,26 @@ type FormBeforeUpdate interface {
 	FormBeforeUpdate(ctx context.Context, model any) error
 }
 
+// FormAfterCreate optionally runs after insert, inside the same transaction.
+type FormAfterCreate interface {
+	FormAfterCreate(ctx context.Context, model any) error
+}
+
+// FormAfterUpdate optionally runs after update, inside the same transaction.
+type FormAfterUpdate interface {
+	FormAfterUpdate(ctx context.Context, model any) error
+}
+
+// FormBeforeDelete optionally rejects a record before delete.
+type FormBeforeDelete interface {
+	FormBeforeDelete(ctx context.Context, model any) error
+}
+
+// FormAfterDelete optionally runs after delete, inside the same transaction.
+type FormAfterDelete interface {
+	FormAfterDelete(ctx context.Context, model any) error
+}
+
 // RelationExtendManageQuery optionally narrows relation-manager candidates.
 type RelationExtendManageQuery interface {
 	RelationExtendManageQuery(ctx context.Context, relation string, db *gorm.DB) *gorm.DB