refactor: [approval] SAM API 규칙 준수 코드 리뷰 반영

- ApprovalStep에 BelongsToTenant, SoftDeletes 추가 (마이그레이션 포함)
- ApprovalForm, ApprovalDelegation에 ModelTrait 추가 (중복 scopeActive 제거)
- ApprovalDelegation에 Auditable 추가
- 모든 결재 액션에 FormRequest 적용 (approve, cancel, hold, preDecide)
- 위임 CRUD에 DelegationStoreRequest, DelegationUpdateRequest 적용
- ApprovalStep 생성 시 tenant_id 포함

app/Http/Controllers/Api/V1/ApprovalController.php

@@ -4,8 +4,14 @@
 
 use App\Helpers\ApiResponse;
 use App\Http\Controllers\Controller;
+use App\Http\Requests\Approval\ApproveRequest;
+use App\Http\Requests\Approval\CancelRequest;
+use App\Http\Requests\Approval\DelegationStoreRequest;
+use App\Http\Requests\Approval\DelegationUpdateRequest;
+use App\Http\Requests\Approval\HoldRequest;
 use App\Http\Requests\Approval\InboxIndexRequest;
 use App\Http\Requests\Approval\IndexRequest;
+use App\Http\Requests\Approval\PreDecideRequest;
 use App\Http\Requests\Approval\ReferenceIndexRequest;
 use App\Http\Requests\Approval\RejectRequest;
 use App\Http\Requests\Approval\StoreRequest;
@@ -133,10 +139,10 @@ public function submit(int $id, SubmitRequest $request): JsonResponse
      * 결재 승인
      * POST /v1/approvals/{id}/approve
      */
-    public function approve(int $id, Request $request): JsonResponse
+    public function approve(int $id, ApproveRequest $request): JsonResponse
     {
         return ApiResponse::handle(function () use ($id, $request) {
-            return $this->service->approve($id, $request->input('comment'));
+            return $this->service->approve($id, $request->validated()['comment'] ?? null);
         }, __('message.approval.approved'));
     }
 
@@ -155,10 +161,10 @@ public function reject(int $id, RejectRequest $request): JsonResponse
      * 결재 회수 (기안자만)
      * POST /v1/approvals/{id}/cancel
      */
-    public function cancel(int $id, Request $request): JsonResponse
+    public function cancel(int $id, CancelRequest $request): JsonResponse
     {
         return ApiResponse::handle(function () use ($id, $request) {
-            return $this->service->cancel($id, $request->input('recall_reason'));
+            return $this->service->cancel($id, $request->validated()['recall_reason'] ?? null);
         }, __('message.approval.cancelled'));
     }
 
@@ -166,15 +172,10 @@ public function cancel(int $id, Request $request): JsonResponse
      * 보류 (현재 결재자만)
      * POST /v1/approvals/{id}/hold
      */
-    public function hold(int $id, Request $request): JsonResponse
+    public function hold(int $id, HoldRequest $request): JsonResponse
     {
         return ApiResponse::handle(function () use ($id, $request) {
-            $comment = $request->input('comment');
-            if (empty($comment)) {
-                throw new \Symfony\Component\HttpKernel\Exception\BadRequestHttpException(__('error.approval.comment_required'));
-            }
-
-            return $this->service->hold($id, $comment);
+            return $this->service->hold($id, $request->validated()['comment']);
         }, __('message.approval.held'));
     }
 
@@ -193,10 +194,10 @@ public function releaseHold(int $id): JsonResponse
      * 전결 (현재 결재자가 이후 모든 결재를 건너뛰고 최종 승인)
      * POST /v1/approvals/{id}/pre-decide
      */
-    public function preDecide(int $id, Request $request): JsonResponse
+    public function preDecide(int $id, PreDecideRequest $request): JsonResponse
     {
         return ApiResponse::handle(function () use ($id, $request) {
-            return $this->service->preDecide($id, $request->input('comment'));
+            return $this->service->preDecide($id, $request->validated()['comment'] ?? null);
         }, __('message.approval.pre_decided'));
     }
 
@@ -296,10 +297,10 @@ public function delegationIndex(Request $request): JsonResponse
      * 위임 생성
      * POST /v1/approvals/delegations
      */
-    public function delegationStore(Request $request): JsonResponse
+    public function delegationStore(DelegationStoreRequest $request): JsonResponse
     {
         return ApiResponse::handle(function () use ($request) {
-            return $this->service->delegationStore($request->all());
+            return $this->service->delegationStore($request->validated());
         }, __('message.created'));
     }
 
@@ -307,10 +308,10 @@ public function delegationStore(Request $request): JsonResponse
      * 위임 수정
      * PATCH /v1/approvals/delegations/{id}
      */
-    public function delegationUpdate(int $id, Request $request): JsonResponse
+    public function delegationUpdate(int $id, DelegationUpdateRequest $request): JsonResponse
     {
         return ApiResponse::handle(function () use ($id, $request) {
-            return $this->service->delegationUpdate($id, $request->all());
+            return $this->service->delegationUpdate($id, $request->validated());
         }, __('message.updated'));
     }
 

app/Http/Requests/Approval/ApproveRequest.php

@@ -0,0 +1,20 @@
+<?php
+
+namespace App\Http\Requests\Approval;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+class ApproveRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    public function rules(): array
+    {
+        return [
+            'comment' => 'nullable|string|max:1000',
+        ];
+    }
+}

app/Http/Requests/Approval/CancelRequest.php

@@ -0,0 +1,20 @@
+<?php
+
+namespace App\Http\Requests\Approval;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+class CancelRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    public function rules(): array
+    {
+        return [
+            'recall_reason' => 'nullable|string|max:1000',
+        ];
+    }
+}

app/Http/Requests/Approval/DelegationStoreRequest.php

@@ -0,0 +1,26 @@
+<?php
+
+namespace App\Http\Requests\Approval;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+class DelegationStoreRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    public function rules(): array
+    {
+        return [
+            'delegate_id' => 'required|integer|exists:users,id',
+            'start_date' => 'required|date|after_or_equal:today',
+            'end_date' => 'required|date|after_or_equal:start_date',
+            'form_ids' => 'nullable|array',
+            'form_ids.*' => 'integer|exists:approval_forms,id',
+            'notify_delegator' => 'nullable|boolean',
+            'reason' => 'nullable|string|max:500',
+        ];
+    }
+}

app/Http/Requests/Approval/DelegationUpdateRequest.php

@@ -0,0 +1,27 @@
+<?php
+
+namespace App\Http\Requests\Approval;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+class DelegationUpdateRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    public function rules(): array
+    {
+        return [
+            'delegate_id' => 'nullable|integer|exists:users,id',
+            'start_date' => 'nullable|date',
+            'end_date' => 'nullable|date|after_or_equal:start_date',
+            'form_ids' => 'nullable|array',
+            'form_ids.*' => 'integer|exists:approval_forms,id',
+            'notify_delegator' => 'nullable|boolean',
+            'is_active' => 'nullable|boolean',
+            'reason' => 'nullable|string|max:500',
+        ];
+    }
+}

app/Http/Requests/Approval/HoldRequest.php

@@ -0,0 +1,27 @@
+<?php
+
+namespace App\Http\Requests\Approval;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+class HoldRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    public function rules(): array
+    {
+        return [
+            'comment' => 'required|string|max:1000',
+        ];
+    }
+
+    public function messages(): array
+    {
+        return [
+            'comment.required' => __('error.approval.comment_required'),
+        ];
+    }
+}

app/Http/Requests/Approval/PreDecideRequest.php

@@ -0,0 +1,20 @@
+<?php
+
+namespace App\Http\Requests\Approval;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+class PreDecideRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    public function rules(): array
+    {
+        return [
+            'comment' => 'nullable|string|max:1000',
+        ];
+    }
+}