test(transport) : rigueur RG sous-ressources (propertyPath, 404 parent, 401, certif)

Repond aux retours de review (rigueur d'assertion transversale) :
- mutualise assertViolationOnPath dans AbstractCarrierApiTestCase (au lieu d'un
  duplicata local a CarrierWriteApiTest) ;
- asserte le propertyPath des 422 des sous-ressources (adresses city/street/postalCode,
  contacts firstName/phones/email, prix clientDeliveryAddress/supplierSupplyAddress/price)
  -> evite les faux-verts du mapping inline (ERP-101) ;
- 404 parent (POST sur /carriers/999999/{addresses,contacts,prices}) ;
- 401 anonyme + filtre ?certificationType= sur la collection (trous releves sur le
  contrat de lecture).

tests/Module/Transport/Api/CarrierContactApiTest.php

@@ -5,7 +5,6 @@ declare(strict_types=1);
 namespace App\Tests\Module\Transport\Api;
 
 use App\Module\Core\Infrastructure\DataFixtures\RbacDemoFixtures;
-use App\Module\Transport\Domain\Entity\Carrier;
 use App\Module\Transport\Domain\Entity\CarrierContact;
 use Symfony\Bundle\FrameworkBundle\Console\Application;
 use Symfony\Component\Console\Input\ArrayInput;
@@ -56,11 +55,13 @@ final class CarrierContactApiTest extends AbstractCarrierApiTestCase
         $carrier = $this->seedCarrier('Contact Vide');
         $client  = $this->createAdminClient();
 
-        $client->request('POST', '/api/carriers/'.$carrier->getId().'/contacts', [
+        $response = $client->request('POST', '/api/carriers/'.$carrier->getId().'/contacts', [
             'headers' => ['Content-Type' => self::LD],
             'json'    => [],
         ]);
         self::assertResponseStatusCodeSame(422);
+        // RG-4.08 : la violation est rattachee a `firstName` (mapping inline ERP-101).
+        self::assertViolationOnPath($response, 'firstName');
     }
 
     public function testSingleFieldContactIsCreated(): void
@@ -87,7 +88,7 @@ final class CarrierContactApiTest extends AbstractCarrierApiTestCase
         $carrier = $this->seedCarrier('Contact Trois Tel');
         $client  = $this->createAdminClient();
 
-        $client->request('POST', '/api/carriers/'.$carrier->getId().'/contacts', [
+        $response = $client->request('POST', '/api/carriers/'.$carrier->getId().'/contacts', [
             'headers' => ['Content-Type' => self::LD],
             'json'    => [
                 'firstName' => 'Jean',
@@ -95,6 +96,35 @@ final class CarrierContactApiTest extends AbstractCarrierApiTestCase
             ],
         ]);
         self::assertResponseStatusCodeSame(422);
+        // Le max-2 cible le champ virtuel `phones` (mapping inline ERP-101).
+        self::assertViolationOnPath($response, 'phones');
+    }
+
+    public function testInvalidEmailReturns422(): void
+    {
+        // L'email du contact porte un Assert\Email (nouvelle contrainte M4) : une
+        // adresse mal formee -> 422 ciblee sur `email`.
+        $carrier = $this->seedCarrier('Contact Email Invalide');
+        $client  = $this->createAdminClient();
+
+        $response = $client->request('POST', '/api/carriers/'.$carrier->getId().'/contacts', [
+            'headers' => ['Content-Type' => self::LD],
+            'json'    => ['lastName' => 'Durand', 'email' => 'pas-un-email'],
+        ]);
+        self::assertResponseStatusCodeSame(422);
+        self::assertViolationOnPath($response, 'email');
+    }
+
+    public function testPostContactOnUnknownCarrierReturns404(): void
+    {
+        // Parent introuvable (read:false) -> 404 explicite du processor.
+        $client = $this->createAdminClient();
+
+        $client->request('POST', '/api/carriers/999999/contacts', [
+            'headers' => ['Content-Type' => self::LD],
+            'json'    => ['lastName' => 'Martin'],
+        ]);
+        self::assertResponseStatusCodeSame(404);
     }
 
     public function testPhonesAreMappedAndNormalized(): void