test(intake): public route invariants and bad-token 404s

Phase 8a Task 17. Mirrors the existing intake-submit.test.ts pattern:
- happy path: card lands in inbox with created_by_role=anonymous
- counter bump: submission_count and last_submission_at update
- hostile brief: server-set fields cannot be overridden, even when
  the body includes top-level priority/accepted/column/created_by
- none of unknown/revoked/expired/malformed tokens reach the
  handler — they all 404 with the same wording
- deleted-project token: link cascades away, 404 follows
- activity log: card_submitted_anonymously row written

Deviation from plan: the second project needs an explicit Inbox
column created in beforeAll — the schema does not auto-create one
for new projects.

tests/integration/intake-submit-public.test.ts

@@ -63,11 +63,15 @@ beforeAll(async () => {
   });
   anotherProjectId = another.id;
 
-  anotherInboxId = (
-    await admin
-      .collection("columns")
-      .getFirstListItem(`project = "${anotherProjectId}" && is_inbox = true`)
-  ).id;
+  // The schema doesn't auto-create an Inbox column for new projects; the test
+  // owns the fixture it relies on.
+  const anotherColumn = await admin.collection("columns").create({
+    project: anotherProjectId,
+    name: "Inbox",
+    position: 1000,
+    is_inbox: true,
+  });
+  anotherInboxId = anotherColumn.id;
 });
 
 afterAll(async () => {