feat(commercial) : referentiel pays (country) en base + branchement front (ERP-116) (#79)

## Objectif (ERP-116, 1re iteration minimale)

Sortir la liste des pays du **code en dur** cote front et la poser en base comme **referentiel `country`**, source unique du select pays. **Perimetre volontairement minimal** : code ISO + libelle + ordre uniquement — **aucune longueur bancaire/fiscale** (numero de compte, IBAN, TVA, BIC, SIREN) a ce stade.

## Backend
- Entite `Country` (`code` ISO 3166-1 alpha-2 unique, `name`, `position`), calquee sur `Bank` : referentiel statique **lecture seule** (`GetCollection` + `Get`), gating `commercial.clients.view OR commercial.suppliers.view`.
- Migration `Version20260609100000` : table `country` + `COMMENT ON COLUMN` + seed des **6 pays** (France, Allemagne, Belgique, Espagne, Italie, Royaume-Uni), `ON CONFLICT DO NOTHING`.
- `CommercialReferentialFixtures` : re-seed des pays en dev/test.
- Garde-fous : ajout au `ColumnCommentsCatalog` + whitelist `EntitiesAreTimestampableBlamableTest`.

## Frontend
- `useClientReferentials` charge `/countries` (value = **nom** du pays : l'adresse stocke `country` en chaine libre, **pas de FK ni migration de donnees**).
- Les 3 listes `countryOptions` en dur (clients new / edit / consultation) sont supprimees ; la consultation derive ses options de l'embed.

## Hors-scope (iterations suivantes du ticket)
- Longueurs bancaires/fiscales par pays + validation associee.
- FK `country_id` sur les adresses + migration de donnees.

## Tests
- Back : suite complete verte (583), tests API dedies countries (200/seed/405/403/401).
- Front : Vitest vert (256), spec `useClientReferentials` mise a jour.
- Migration appliquee en dev + test.

---------

Co-authored-by: Matthieu <contact@malio.fr>
Reviewed-on: #79

tests/Module/Commercial/Api/ReferentialApiTest.php

@@ -241,6 +241,72 @@ final class ReferentialApiTest extends AbstractCommercialApiTestCase
         self::assertResponseStatusCodeSame(401);
     }
 
+    /**
+     * Referentiel pays (ERP-116) — teste a part des 4 referentiels comptables
+     * car il expose `name` (et non `label`). Memes garanties : 200 + seed des 7
+     * pays, France en tete (position ASC), lecture seule (405), gating (403/401).
+     */
+    public function testCountriesCollectionReturns200WithSeed(): void
+    {
+        $client   = $this->createAdminClient();
+        $response = $client->request('GET', '/api/countries?pagination=false', ['headers' => ['Accept' => self::LD]]);
+
+        self::assertResponseStatusCodeSame(200);
+
+        $members = $response->toArray()['member'];
+        $codes   = array_map(static fn (array $m): string => $m['code'], $members);
+
+        foreach (['FR', 'DE', 'BE', 'ES', 'IT', 'GB', 'CH'] as $expected) {
+            self::assertContains($expected, $codes, '/api/countries doit exposer le pays seede '.$expected);
+        }
+
+        // Le DTO de lecture expose id / code / name / position.
+        $first = $members[0];
+        self::assertArrayHasKey('id', $first);
+        self::assertArrayHasKey('name', $first);
+        self::assertArrayHasKey('position', $first);
+        // Tri par defaut position ASC : France (position 10) en tete.
+        self::assertSame('FR', $first['code'], 'France (FR) doit etre en tete (position 10, tri position ASC).');
+    }
+
+    public function testCountriesGetItemReturns200(): void
+    {
+        $client = $this->createAdminClient();
+
+        $first = $client->request('GET', '/api/countries?pagination=false', ['headers' => ['Accept' => self::LD]])
+            ->toArray()['member'][0]
+        ;
+
+        $client->request('GET', '/api/countries/'.$first['id'], ['headers' => ['Accept' => self::LD]]);
+        self::assertResponseStatusCodeSame(200);
+    }
+
+    public function testCountriesPostReturns405(): void
+    {
+        $client = $this->createAdminClient();
+        $client->request('POST', '/api/countries', [
+            'headers' => ['Content-Type' => self::LD],
+            'json'    => ['code' => 'XX', 'name' => 'Pays X', 'position' => 1],
+        ]);
+        self::assertResponseStatusCodeSame(405);
+    }
+
+    public function testCountriesForbiddenWithoutPermission(): void
+    {
+        $creds  = $this->createUserWithPermission('core.users.view');
+        $client = $this->authenticatedClient($creds['username'], $creds['password']);
+
+        $client->request('GET', '/api/countries', ['headers' => ['Accept' => self::LD]]);
+        self::assertResponseStatusCodeSame(403);
+    }
+
+    public function testCountriesUnauthorizedWhenAnonymous(): void
+    {
+        $client = self::createClient();
+        $client->request('GET', '/api/countries', ['headers' => ['Accept' => self::LD]]);
+        self::assertResponseStatusCodeSame(401);
+    }
+
     /**
      * @return iterable<string, array{string, list<string>}>
      */