fix(ori): surface closeVotingRound failures explicitly and add bearer auth to ORI publication

[rubenvdlinde]

Summary

Fixes 2 ORI/lifecycle correctness issues found in the quality-loop review.

• [MEDIUM] M7: VotingService::closeVotingRound swallows lifecycle-transition and ORI-publication failures silently #318 VotingService::closeVotingRound no longer swallows lifecycle-transition and ORI-publication failures silently:
  • \InvalidArgumentException from the state-machine (bad transition) is now re-thrown as a \RuntimeException so the controller returns an explicit error response instead of silently returning a stale round.
  • Infrastructure/transient errors are promoted from WARNING to ERROR log level so they surface in monitoring.
  • ORI publication errors are attached to the returned round payload under oriPublicationError.
• [LOW] L2: OriPublicationService::publish sends no authentication header — ORI endpoint auth not configurable #320 OriPublicationService::publish reads ori_bearer_secret from IAppConfig and includes it as an Authorization: Bearer header when configured. The key is added to SettingsService::CONFIG_KEYS so it can be saved from the admin settings UI.

Test plan

• PHP syntax clean on all 3 changed files
• Run composer test (VotingServiceTest is skipped per issue Broken: 21 unit tests fail due to ObjectService stub/real-signature mismatch #90)
• Configure ori_bearer_secret in admin settings and verify Authorization header is sent in a test POST to a mock endpoint
• Verify that closeVotingRound on a round with a motion already in adopted state (invalid transition) returns HTTP 400 with an error message
• Verify ORI publication failure (wrong endpoint) is logged at ERROR level and returned in the round's oriPublicationError field