fix(security): wave-3 critical fixes

[rubenvdlinde]

Summary

Fixes all 4 wave-3 CRITICAL findings verified in /tmp/triage-openbuilt.md.

• C1 (ApplicationInsightsService): Inject SchemaMapper, resolve schema slugs to integer IDs via SchemaMapper::find() before passing to AuditTrailMapper. array_map('intval', $schemaIds) converted every slug string to 0, silently zeroing all KPI dashboard values on every install.

• C2 (ManifestResolverService + ApplicationsController): Replace three 'application-version' string literals with ApplicationVersionService::APPLICATION_VERSION_SCHEMA ('applicationVersion'). SchemaMapper lowercases before compare — 'applicationversion' ≠ 'application-version' — so every ?_version= manifest route and the diff endpoint silently returned null (DoesNotExistException swallowed as 404).

• C3 (RunExportJob + ExportJobService): Add ExportJobService::loadJob(), call it at the top of executePipeline() to read the real applicationUuid/applicationVersion/applicationSlug/license from the queued OR record. Old code passed $jobUuid as applicationUuid and hardcoded 'exported-app'/'0.1.0', making every export produce the same generic stub.

• C4 (ApplicationsController::persistApplication): Populate permissions.owners = ['user:<ownerUid>'] on the cloned Application. Without this, PermissionResolver::matchesCaller returned false on empty permissions, immediately 403-ing non-admin citizen-developers from their own template clones.

Test plan

• PHPStan: no errors in changed files (56 pre-existing baseline errors unaffected)
• PHPUnit: all 262 unit tests pass
• C2 runtime: GET /api/apps/{slug}/manifest?_version={versionSlug} returns 200
• C3 runtime: exported ZIP file name and content reflect actual app slug + version
• C4 runtime: non-admin user who clones a template can read/edit/delete the clone