feat(api): upgrade to API Platform 4.3 and Symfony 8

[soyuka]

Upgrades the api/ (Symfony) backend two majors: API Platform 3 → 4.3 and Symfony 6.2 → 8.1. Targets staging.

Split out from the frontend security PR (#676) per request — that PR is pwa-only, this one is api-only.

Dependencies

• api-platform/core ^3.0 → ^4.3 (resolves 4.3.10)
• symfony/* 6.2.* → 8.1.* (resolves 8.1.0)
• doctrine/orm ^2.12 → ^3.6, doctrine-bundle ^2.7 → ^3.2, doctrine-migrations-bundle ^3.2 → ^4.0 — required for Symfony 8
• monolog-bundle ^3.8 → ^4.0, mercure-bundle ^0.3.5 → ^0.4, nelmio/cors-bundle ^2.2 → ^2.6
• php >=8.2 → >=8.4 (Symfony 8 requirement)

Config

• Dropped doctrine ORM proxy options removed in doctrine-bundle 3 (auto_generate_proxy_classes, proxy_dir, enable_lazy_ghost_objects) — now no-ops with native lazy objects
• Gitignore /config/reference.php (Symfony 8 generated IDE-autocomplete artifact)

Verification

• composer audit — clean
• lint:container — OK
• cache:clear --env=prod — OK
• debug:api-resource App\Entity\Greeting — wires all 5 REST operations under API Platform 4

Notes

• One INFO-level deprecation remains from a third-party bundle still extending the deprecated HttpKernel\...\Extension class — not our code.
• This also supersedes the Symfony 6.4 security bump that was originally in fix(deps): patch frontend (pwa) dependabot security advisories #676 (now removed from that PR).