Public Webforms: Sandbox cleanup

[nospame]

Technical Summary

• Last of three PRs in this repo for Public Webforms. A public session restores under a unique
  synthetic user, creating a persistent on-disk sandbox that is never reused once the one-time link
  is consumed. This PR deletes that sandbox on successful submit so they don't accumulate.
  • FormSubmissionHelper: on a confirmed submit (where the form session is deleted — the point HQ
    fires consume_public_form_session), a public session marks its request-scoped RestoreFactory
    for cleanup.
  • UserRestoreAspect#closeRestoreFactory: deletes the sandbox folder after the connection is
    closed, best-effort. Removing the one user folder reclaims both the user DB and the nested app DB.
• Runs only on a genuine submit (in-form actions leave an in-progress form intact) and also covers
  the auto-submit-on-get_endpoint path. Identity is the HQ-pinned restore user, never
  client-supplied — which is why this is server-side rather than exposing clear_user_data.

Code and this description written or co-written by AI and edited by human.

Safety Assurance

Safety story

Scope is tightly bounded: cleanup only fires for a public session, only on a successful submit, and
deletes only that session's own single-use sandbox (identity taken from the pinned RestoreFactory,
never the request body). Deletion happens after the connection closes and is wrapped best-effort, so
a cleanup failure logs and never fails the submit. No regular-user or shared data is touched.

Automated test coverage

• UserRestoreAspectTest — marked → sandbox deleted after close; not marked → left intact; delete
  failure is swallowed. (Verified locally: passing.)

QA Plan

This particular change will not get QA.

Special deploy instructions

• This PR can be deployed after merge with no further considerations.

Rollback instructions

• This PR can be reverted after deploy with no further considerations. (Reverting just stops the eager cleanup; abandoned/older sandboxes are already handled by the out-of-band old-user-DB purge.)

Review

• The set of people pinged as reviewers is appropriate for the level of risk of the change.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 70.67%. Comparing base (0cc49f1) to head (176ec7d).

Additional details and impacted files

@@             Coverage Diff              @@
##             master    #1793      +/-   ##
============================================
+ Coverage     70.59%   70.67%   +0.07%     
- Complexity     2094     2100       +6     
============================================
  Files           260      260              
  Lines          8119     8132      +13     
  Branches        794      796       +2     
============================================
+ Hits           5732     5747      +15     
+ Misses         2096     2094       -2     
  Partials        291      291              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.