test(transport) : rigueur RG sous-ressources (propertyPath, 404 parent, 401, certif)

Repond aux retours de review (rigueur d'assertion transversale) :
- mutualise assertViolationOnPath dans AbstractCarrierApiTestCase (au lieu d'un
  duplicata local a CarrierWriteApiTest) ;
- asserte le propertyPath des 422 des sous-ressources (adresses city/street/postalCode,
  contacts firstName/phones/email, prix clientDeliveryAddress/supplierSupplyAddress/price)
  -> evite les faux-verts du mapping inline (ERP-101) ;
- 404 parent (POST sur /carriers/999999/{addresses,contacts,prices}) ;
- 401 anonyme + filtre ?certificationType= sur la collection (trous releves sur le
  contrat de lecture).

tests/Module/Transport/Api/CarrierAddressApiTest.php

@@ -4,7 +4,6 @@ declare(strict_types=1);
 
 namespace App\Tests\Module\Transport\Api;
 
-use ApiPlatform\Symfony\Bundle\Test\Client;
 use App\Module\Core\Infrastructure\DataFixtures\RbacDemoFixtures;
 use App\Module\Transport\Domain\Entity\Carrier;
 use App\Module\Transport\Domain\Entity\CarrierAddress;
@@ -56,11 +55,13 @@ final class CarrierAddressApiTest extends AbstractCarrierApiTestCase
         $carrier = $this->seedCarrierWithChartered('Cp Invalide', false);
         $client  = $this->createAdminClient();
 
-        $client->request('POST', '/api/carriers/'.$carrier->getId().'/addresses', [
+        $response = $client->request('POST', '/api/carriers/'.$carrier->getId().'/addresses', [
             'headers' => ['Content-Type' => self::LD],
             'json'    => ['postalCode' => '123'], // 3 chiffres -> Regex KO
         ]);
         self::assertResponseStatusCodeSame(422);
+        // La 422 doit cibler le champ fautif (mapping inline ERP-101), pas juste le code HTTP.
+        self::assertViolationOnPath($response, 'postalCode');
     }
 
     public function testInconsistentPostalCodeAndCityIsAccepted(): void
@@ -90,11 +91,15 @@ final class CarrierAddressApiTest extends AbstractCarrierApiTestCase
         $carrier = $this->seedCarrierWithChartered('Affrete Incomplet', true);
         $client  = $this->createAdminClient();
 
-        $client->request('POST', '/api/carriers/'.$carrier->getId().'/addresses', [
+        $response = $client->request('POST', '/api/carriers/'.$carrier->getId().'/addresses', [
             'headers' => ['Content-Type' => self::LD],
             'json'    => ['postalCode' => '86000'],
         ]);
         self::assertResponseStatusCodeSame(422);
+        // RG-4.05 mappe une violation PAR champ manquant (ville + rue ici) -> chaque
+        // erreur s'affiche inline sous son champ (ERP-101).
+        self::assertViolationOnPath($response, 'city');
+        self::assertViolationOnPath($response, 'street');
     }
 
     public function testCharteredCarrierCompleteAddressIsCreated(): void
@@ -114,6 +119,19 @@ final class CarrierAddressApiTest extends AbstractCarrierApiTestCase
         self::assertResponseStatusCodeSame(201);
     }
 
+    public function testPostAddressOnUnknownCarrierReturns404(): void
+    {
+        // Sous-ressource en read:false : le parent introuvable n'est plus intercepte
+        // en amont -> le processor doit lever un 404 explicite (sinon 500 au persist).
+        $client = $this->createAdminClient();
+
+        $client->request('POST', '/api/carriers/999999/addresses', [
+            'headers' => ['Content-Type' => self::LD],
+            'json'    => ['postalCode' => '86000', 'city' => 'Poitiers', 'street' => '1 rue X'],
+        ]);
+        self::assertResponseStatusCodeSame(404);
+    }
+
     public function testPatchAndDeleteSucceedWithManage(): void
     {
         $address = $this->seedAddress('Patch Delete', false);