fix(flow): enforce native form validation and leave script validation to the GUI

[abrichr]

Fifth of six fixes from an external review of #1269. Stacked on #1370 (then #1369, #1368).

Bug

Only validate.js presence rules were enforced. A browser also checks native HTML constraints before it submits, and a form's own script can validate or rewrite values. The API step skipped both.

Fix

Evaluated by the API step (build_body, on what it sends):

• native constraints: required, minlength, maxlength, pattern, min, max, and the email, url, number/range and date input types;
• validate.js rules: presence, length, format, numericality, email.

Left to the GUI (refused at proposal; at run time the step is unavailable when the live form has it):

• an on* handler on the form (onsubmit) or on a field the save sends (onchange, oninput, onblur);
• a page script listening for submit;
• a validate.js rule of any other kind.

On the real OpenEMR recording this finds three things:

• onsubmit='return submitme(1,event,"DEM",constraints)';
• onchange='checkSkipConditions();capitalizeMe(this);' on each name field. capitalizeMe rewrites the typed value, so the API step would have saved a different name than the GUI;
• a custom pastDate rule on the date of birth, which the API step never enforced.

So the referral save stays on the GUI. The reviewer's escape hatch, letting qualification show that the server enforces a script-only rule, is documented as not built. Python's re approximates the browser's pattern; a pattern that doesn't compile keeps the save on the GUI.

Tests

tests/test_api_step_native_validation.py (new):

• each native constraint refuses what the browser would and accepts valid values;
• validate.js length, format and numericality are enforced;
• the actuator refuses an invalid value before sending;
• four script cases are refused at proposal and unavailable at run time: onsubmit, onchange, a submit listener, and a pastDate rule.

80 pass with the API-tier, approval, provenance, URL and other-writes tests. API_TIER.md is updated.

Synthetic values only.

🤖 Generated with Claude Code

[abrichr]

Included in batch #1383, which runs CI once for several reviewed PRs. This PR is marked merged when #1383 merges. Please don't push here unless asked; a new commit leaves it out of the batch.