feat(qualia): add all-forms admin endpoint

[augmentcode]

Problem

• Qualia only exposed /api/v1/forms/ for published forms scoped to the current user, so admins had no endpoint to inspect every form cycle, including drafts and unpublished entries.

Solution

• Add an admin-only GET /api/v1/forms/all route in qualia/backend/app/form_cycles.py that returns all form cycles with the existing list fields, ordered consistently for backend consumers.
• Add focused backend coverage in qualia/backend/tests/test_form_cycles_list_all.py for both the successful admin response and the non-admin 403 path.

Testing

• qualia/backend/.venv/bin/pytest tests/test_form_cycles_list_all.py ✅
• qualia/backend/.venv/bin/pytest shows 4 failures that are already reproducible on a clean origin/main branch and are unrelated to this change.

Misc

• This was a manual session, but only github-app-api was available here, so PR attribution uses the bot surface instead of the normal manual-session GitHub tool.

---

Pull Request opened by Augment Code | View session

[augmentcode]

^{PR Author Agent⚡}

👋 I've got this PR.

I'll handle review feedback, CI failures, and merge conflicts, and ping you the moment it's ready for review. Drop a comment anytime.

Marking it ready and picking reviewers are your call — I'll leave both alone.

[ahmadJT]

Provide a more detailed PR description

[augmentcode]

^{PR Author Agent⚡}

Updated the PR description with more detail on the missing admin use case, the new GET /api/v1/forms/all route, the focused test coverage, and the existing unrelated full-suite failures on origin/main.

[augmentcode]

🤖 Augment PR Summary

Summary: This PR adds an admin-only endpoint to list all form cycles, including drafts and unpublished cycles.

Changes:

• Introduced a new response schema (AdminFormCycleListItem) that includes publish state and timestamps
• Added GET /api/v1/forms/all to return every FormCycle for authorized admins
• The endpoint enforces admin authorization via get_bearer_token + _get_authorized_admin
• Query returns cycles in a stable order (by created_at, then id)
• Added focused backend tests covering the happy path (admin) and rejection path (non-admin)

Technical Notes: The tests stub the async DB session and patch token verification to validate access control and response serialization.

_{🤖 Was this summary useful? React with 👍 or 👎}

[augmentcode]

Review completed. 1 suggestion posted.

Comment augment review to trigger a new review at any time.

[augmentcode]

qualia/backend/tests/test_form_cycles_list_all.py: This file is missing a trailing newline at EOF (shown by the \ No newline at end of file marker in the diff), which can cause noisy diffs and some tooling/linters to fail.

Severity: low

_{🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.}

[augmentcode]

^{PR Author Agent⚡}

Fixed in f776f47 by adding the missing trailing newline at EOF, and re-ran qualia/backend/.venv/bin/pytest qualia/backend/tests/test_form_cycles_list_all.py successfully.