v0.2.0 (4/N): make:bridge:resource --with-dto + symfony/validator

Closes the input-validation gap that was the audit's headline finding.
The legacy generated controller's `if (isset($data['title']))…` body
accepted any JSON: empty title slipped through, malformed JSON got
swallowed by `?? []`, wrong types were silently coerced via casts.

The --with-dto flag generates:
  - src/Dto/Create<Name>Dto.php — readonly DTO with #[Assert\NotBlank]
    on title and #[Assert\Length(max: 255)]
  - src/Dto/Update<Name>Dto.php — same DTO with all fields nullable
    so PATCH callers send only what changed
  - src/Controller/<Name>Controller.php — same shape as the legacy
    controller but actions dispatch via #[MapRequestPayload]

Validation failures (missing required field, wrong type, malformed
JSON, oversize string) become RFC 7807 application/problem+json
automatically — Symfony's RequestPayloadValueResolver does the work.
No `if-isset` boilerplate, no silent coercion.

Behaviour:
  - --with-dto is opt-in; legacy template still ships unchanged
  - audit suggests flipping to default-on once stable; that's a
    follow-up
  - maker fails loud (composer require hint) if symfony/validator
    isn't autoloadable
  - skeleton + example/todo composer.json pull symfony/validator so
    scaffolded apps work out of the box

Snapshot test exercises both modes (legacy + --with-dto). New
baselines TodoControllerWithDto.php / CreateTodoDto.php /
UpdateTodoDto.php under tests/snapshot/.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

framework/php/tests/snapshot/run.sh

@@ -24,18 +24,6 @@ sed -i "s|\"../../php\"|\"$BUNDLE\"|" "$APP/symfony/composer.json"
 rm -f "$APP/symfony/composer.lock"
 ( cd "$APP/symfony" && composer install --no-interaction --quiet )
 
-# Remove the existing maker outputs so the regenerators don't bail.
-rm -f "$APP/symfony/src/Entity/Todo.php"
-rm -f "$APP/symfony/src/Controller/TodoController.php"
-rm -f "$APP/qml/TodoList.qml"
-
-# Run every maker we cover.
-( cd "$APP/symfony" \
-    && bin/console make:bridge:resource Todo --no-interaction >/dev/null \
-    && bin/console make:bridge:command MarkAllDone --no-interaction >/dev/null \
-    && bin/console make:bridge:window Todo --no-interaction >/dev/null )
-
-# Compare each generated file to its snapshot baseline.
 fail=0
 check() {
     local generated="$1"
@@ -49,15 +37,42 @@ check() {
     fi
 }
 
-check "$APP/symfony/src/Entity/Todo.php"               "$SCRIPT_DIR/Todo.php"
-check "$APP/symfony/src/Controller/TodoController.php" "$SCRIPT_DIR/TodoController.php"
-check "$APP/qml/TodoList.qml"                          "$SCRIPT_DIR/TodoList.qml"
+clear_outputs() {
+    rm -f "$APP/symfony/src/Entity/Todo.php"
+    rm -f "$APP/symfony/src/Controller/TodoController.php"
+    rm -f "$APP/symfony/src/Dto/CreateTodoDto.php"
+    rm -f "$APP/symfony/src/Dto/UpdateTodoDto.php"
+    rm -f "$APP/qml/TodoList.qml"
+}
+
+# ── Mode 1: legacy (no --with-dto) ────────────────────────────────────
+clear_outputs
+( cd "$APP/symfony" \
+    && bin/console make:bridge:resource Todo --no-interaction >/dev/null \
+    && bin/console make:bridge:command MarkAllDone --no-interaction >/dev/null \
+    && bin/console make:bridge:window Todo --no-interaction >/dev/null )
+
+check "$APP/symfony/src/Entity/Todo.php"                      "$SCRIPT_DIR/Todo.php"
+check "$APP/symfony/src/Controller/TodoController.php"        "$SCRIPT_DIR/TodoController.php"
+check "$APP/qml/TodoList.qml"                                 "$SCRIPT_DIR/TodoList.qml"
 check "$APP/symfony/src/Controller/MarkAllDoneController.php" "$SCRIPT_DIR/MarkAllDoneController.php"
-check "$APP/qml/TodoWindow.qml"                        "$SCRIPT_DIR/TodoWindow.qml"
+check "$APP/qml/TodoWindow.qml"                               "$SCRIPT_DIR/TodoWindow.qml"
+
+# ── Mode 2: --with-dto (re-runs make:bridge:resource only) ────────────
+# The entity + QML output is byte-identical between modes; only the
+# controller swaps and the two DTOs appear. Re-checking the unchanged
+# outputs would just be noise.
+clear_outputs
+( cd "$APP/symfony" \
+    && bin/console make:bridge:resource Todo --with-dto --no-interaction >/dev/null )
+
+check "$APP/symfony/src/Controller/TodoController.php" "$SCRIPT_DIR/TodoControllerWithDto.php"
+check "$APP/symfony/src/Dto/CreateTodoDto.php"         "$SCRIPT_DIR/CreateTodoDto.php"
+check "$APP/symfony/src/Dto/UpdateTodoDto.php"         "$SCRIPT_DIR/UpdateTodoDto.php"
 
 if [ "$fail" -ne 0 ]; then
     echo "Snapshot test failed. If the change is intended, update the baselines under $SCRIPT_DIR/." >&2
     exit 1
 fi
 
-echo "All maker outputs match snapshots."
+echo "All maker outputs match snapshots (legacy + --with-dto modes)."