Public Webforms: Sandbox cleanup

[nospame]

Technical Summary

• Last of three PRs in this repo for Public Webforms. A public session restores under a unique
  synthetic user, creating a persistent on-disk sandbox that is never reused once the one-time link
  is consumed. This PR deletes that sandbox on successful submit so they don't accumulate.
  • FormSubmissionHelper: on a confirmed submit (where the form session is deleted — the point HQ
    fires consume_public_form_session), a public session marks its request-scoped RestoreFactory
    for cleanup.
  • UserRestoreAspect#closeRestoreFactory: deletes the sandbox folder after the connection is
    closed, best-effort. Removing the one user folder reclaims both the user DB and the nested app DB.
• Runs only on a genuine submit (in-form actions leave an in-progress form intact) and also covers
  the auto-submit-on-get_endpoint path. Identity is the HQ-pinned restore user, never
  client-supplied — which is why this is server-side rather than exposing clear_user_data.

Code and this description written or co-written by AI and edited by human.

Safety Assurance

Safety story

Scope is tightly bounded: cleanup only fires for a public session, only on a successful submit, and
deletes only that session's own single-use sandbox (identity taken from the pinned RestoreFactory,
never the request body). Deletion happens after the connection closes and is wrapped best-effort, so
a cleanup failure logs and never fails the submit. No regular-user or shared data is touched.

Automated test coverage

• UserRestoreAspectTest — marked → sandbox deleted after close; not marked → left intact; delete
  failure is swallowed. (Verified locally: passing.)

QA Plan

This particular change will not get QA.

Special deploy instructions

• This PR can be deployed after merge with no further considerations.

Rollback instructions

• This PR can be reverted after deploy with no further considerations. (Reverting just stops the eager cleanup; abandoned/older sandboxes are already handled by the out-of-band old-user-DB purge.)

Review

• The set of people pinged as reviewers is appropriate for the level of risk of the change.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 70.52%. Comparing base (ca819c9) to head (da9444f).

Additional details and impacted files

@@                          Coverage Diff                          @@
##             ejp/public-webforms-confinement    #1793      +/-   ##
=====================================================================
+ Coverage                              70.45%   70.52%   +0.07%     
- Complexity                              2079     2085       +6     
=====================================================================
  Files                                    260      260              
  Lines                                   8103     8116      +13     
  Branches                                 790      792       +2     
=====================================================================
+ Hits                                    5709     5724      +15     
+ Misses                                  2099     2097       -2     
  Partials                                 295      295              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.