…alization

The registry `constraints` column held a PHP-serialized object graph, read back with
`unserialize()`. This replaces that format with the constraint DSL the back-office
"Validation" field already shows, so reading a row means parsing a grammar whose class
names come from a core-owned allowlist, never from the stored value. No `unserialize()`
remains on this path.

Grammar (both implementations, PHP and the TypeScript builder):

- a composite may now carry its own options ahead of its children —
  `Collection(allowExtraFields: true)[ name: NotBlank ]`. This fixes a live bug: a
  definition holding a Collection could not be re-saved from the back office, because
  toNames() emitted the `Required` wrappers that fromNames() then refused;
- `Required`/`Optional` become internal aliases, parseable only as Collection fields and
  never exposed in the builder catalog;
- rendering resolves an alias through a reverse map instead of getShortName(), so a class
  outside the grammar is structurally unrenderable;
- `callback`, `normalizer` and every `*PropertyPath` option are refused wherever a
  constraint is built — the round-trip alone does not catch them, they render and re-parse
  perfectly;
- parsing is bounded in depth, length and token count, since the stored text is reachable
  through the database.

ExtraPropertyConstraintCodec owns the storage contract:

- encode() validates the object graph handed over by module code, renders it, decodes what
  it just produced and compares both graphs strictly. That round-trip replaces an
  exhaustive per-constraint option schema: anything the grammar cannot carry is refused at
  write time rather than dropped silently. The comparison is structural, not `==`, which
  would treat 5 and '5' as equal where the DSL keeps them apart;
- `groups` other than the default and non-null `payload` are refused explicitly, being
  excluded from the rendered form by design;
- reading stays fail-safe: a corrupt root constraint is dropped and logged with its
  registry context, its valid siblings stay active, and a front-office render never dies
  on a tampered row. Writing fails closed, before any DDL runs.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Fixes a real defect found in review, and reshapes the API along the lines the
reviewers asked for.

The defect (spotted by @cnavarro-prestashop): the registry guard did not refuse
everything save() refuses. assertEncodable() walked the object graph, while
encode() also renders and round-trips, so a constraint such as
Choice(['choices' => ['a' => 1]]) passed step 1 and threw at step 8 — after the
DDL had already created its storage column. The guard is now a genuine dry-run of
encode(), so the two cannot diverge again.

API changes:

- ExtraPropertyConstraintCodec becomes ExtraPropertyConstraintEncoder, following
  the Symfony naming where an Encoder also decodes;
- it becomes a service with no constructor dependency, injected into the registry
  and the repository. ExtraPropertyDefinition::fromRow() builds one on demand,
  being a static factory that cannot receive injection;
- the rejection callback is gone. decodeTolerant() returns a DecodedConstraints
  value carrying both the constraints and the rejections, so the reporting no
  longer travels through the method contract and stays testable on its own. The
  two decoding modes keep distinct names rather than a runtime flag: their failure
  contracts differ — decode() throws, decodeTolerant() never does — and a method
  name is checked when reading the call site;
- the length bound is applied by a single private guard shared by both decoding
  paths, instead of sitting at different levels on each side.

Repository and mapper:

- hydrateDefinition() becomes enrichRowsWithDecodedConstraints(), taking rows and
  returning rows like the other enriching steps, with the construction left at the
  call sites;
- the logger is no longer nullable: the dedicated LegacyLogger service is reachable
  from every container, including the hand-built front-office one, which an
  integration test now pins;
- maxRawLength()/maxNestingDepth() become public constants;
- fromNames() goes through tokenize(), which now carries the token-count bound so
  every caller splitting a definition gets it. ConstraintRowPresenter guards its
  own calls: displaying a definition must degrade to an empty builder rather than
  break the page.

Kept as is, with the reasoning recorded: rows always carry composite_options,
because the form type binds the field on every row regardless, and the registry
still logs before throwing, like its five sibling steps.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

- The class becomes ExtraPropertyConstraintNormalizer, matching the interfaces
  it implements. Second rename in this PR: the first followed the earlier
  Encoder suggestion, before the normalizer contracts were settled on.

- ExtraPropertyDefinition no longer decodes anything. fromRow() receives
  constraints already decoded and carries them through, so the value object
  stops instantiating a normalizer of its own. Nothing is lost: the repository
  is fromRow()'s only production caller and already decodes upstream.

- assertNormalizable() is gone. The registry calls normalize() directly and
  discards the result, with a comment saying why: the guard has to stay a full
  dry-run of what save() performs.

- supportsNormalization()/supportsDenormalization() now inspect the data rather
  than only the type, which is what the interfaces pass it for. The
  denormalization side examines the stored string against the grammar — bounds,
  allowlisted names, forbidden options — and rejects an unknown name on its name
  alone, building nothing to decide.

They stay deliberately shallower than normalizing, and the registry keeps its
dry-run rather than relying on them. A constraint can pass every name-level
check and still be unrenderable — Choice(['choices' => ['a' => 1]]) is the case
that motivated the earlier fix — and a boolean carries no reason, where the
registry needs the message for its exception, the back-office flash and the
module install error. A test pins that asymmetry.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

…composites

Restores tests this PR had no business touching. Replacing the constraint tests
in ExtraPropertyDefinitionFromRowTest used an anchor-delimited edit that swept
away five unrelated methods and a data provider, among them the default-value
hydration test whose docblock pins a historical bug — a naive (string)/(bool)
round-trip that lost a false default on reload. They are back verbatim from
9.2.x and pass unchanged.

The LegacyLogger service moves out of the extra property config into
adapter/common.yml, where it belongs: nothing about it is extra-property
specific, and that file is loaded by every container. It is private, and the
front office aliases LoggerInterface onto it in config/services/front/
services_prod.yml — a file the Symfony kernels never load, so their own logger
binding is untouched while front-office autowiring gains the interface.

Test coverage for the composite options tail, which was propagated through
existing expectations without a single case exercising it: the row presenter now
covers a Collection and a list composite carrying their own options, checking the
split between the children tail and the options tail, and the form test covers
one composite surviving a submit.

Also on the normalizer tests: the round-trip over every public constraint now
asserts no rejection was reported, which makes the dedicated clean-value test
redundant; the Collection wrappers test states both halves of its rule, accepted
as Collection fields and refused anywhere else; and the tautological registry
guard test is removed, a leftover from when assertNormalizable() existed — it
asserted normalize() throws, then asserted normalize() throws.

The keyed-map limitation stays, with the test comment now describing it as a
known limitation to revisit rather than a desirable rule. Follow-up tracked in
epic PrestaShop#41422: Symfony ignores the keys of Choice::$choices, so normalizing such a
map to its values would change no validation behaviour — what it changes is the
strict round-trip contract, which deserves its own decision.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

…ration

Hydrating a definition whose stored constraints cannot be decoded logs the
rejection. With the legacy logger that log is a PrestaShopLogger row, and
ObjectModel::add() loaded every definition to validate extra properties
before writing it, which decoded the same row and logged it again, without
end: one corrupt row, or any row still holding a PHP-serialized blob from a
9.2 beta install, took every back-office page to a 500 and every
front-office page to max_execution_time.

Three independent guards:

- ObjectModel::validateExtraProperties() and persistExtraProperties() return
  at once when no extra property value was ever set on the instance, so
  saving an entity without extra properties never touches the definitions
  repository.
- ExtraPropertyDefinitionRepository reports a rejection once per row content
  and per instance, marking it before calling the logger, so a logger that
  hydrates the definitions itself finds it already reported. This also keeps
  the Logs page to one line per bad row.
- The repository takes Psr\Log\LoggerInterface instead of the legacy adapter
  service: the Symfony kernels resolve it to Monolog (no database write),
  only the hand-built front-office container aliases it to the legacy logger.

… after a dropped All

- prestashop.adapter.legacy.logger moves from adapter/services.yml to
  adapter/common.yml, so the hand-built front-office container gets the same
  service the Symfony kernels already had instead of a second LegacyLogger
  instance (prestashop.adapter.legacy.logger.shared is removed). The
  front-office alias of Psr\Log\LoggerInterface points at it.
- ConstraintRowPresenter::rows() marks the first All[...] as exploded only
  once its children tokenized: an All with unrepresentable children (a
  hand-edited row) is dropped and the next top-level All still feeds the
  per-language zone instead of presenting as an opaque set-level row.

The webservice runs on its own hand-built container (webservice/dispatcher.php),
built from config/services/webservice/*.yml, which imports config/services/common.yml
like the front one does. The Psr\Log\LoggerInterface alias lived in the front-office
file only, so the extra property repository could not be built there and every
webservice request failed. The alias now sits in config/services/common.yml, loaded
by the hand-built containers only; the Symfony kernels keep Monolog. The container
test covers the webservice container as well.