Phase 1 sub-commit 2: Symfony bundle internals

Bundle code for php-qml/bridge: BridgeBundle (AbstractBundle, autoloads
config/services.yaml), Publisher (thin wrapper over Mercure HubInterface
that enforces envelope-as-JSON), SessionAuthenticator (bearer-token
custom Symfony authenticator with problem+json failures), and
HealthController (GET /healthz readiness probe).

Composer constraints bumped to Symfony ^8.0 across the board (per user
request); mercure component to ^0.7. PHPUnit 11 suite covers Publisher
publish + private flag and SessionAuthenticator support/auth/failure
paths — 8 tests, 22 assertions, all green.

PLAN.md §13 updated to record the Symfony 8 minimum.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

framework/php/composer.json

@@ -5,14 +5,21 @@
     "license": "proprietary",
     "require": {
         "php": "^8.3",
-        "symfony/framework-bundle": "^7.1"
+        "symfony/framework-bundle": "^8.0",
+        "symfony/mercure": "^0.7",
+        "symfony/security-bundle": "^8.0",
+        "symfony/routing": "^8.0",
+        "symfony/http-foundation": "^8.0",
+        "symfony/console": "^8.0",
+        "symfony/dependency-injection": "^8.0",
+        "symfony/config": "^8.0"
     },
     "require-dev": {
         "phpunit/phpunit": "^11",
         "phpstan/phpstan": "^2",
         "phpstan/phpstan-symfony": "^2",
         "friendsofphp/php-cs-fixer": "^3",
-        "symfony/phpunit-bridge": "^7.1"
+        "symfony/phpunit-bridge": "^8.0"
     },
     "autoload": {
         "psr-4": {