feat: auto-check all wizard step checkboxes and require them before advancing (ENH-008)

[ffooll-bit]

Summary

Every PISN graduation wizard verification step now has a checkbox that must be checked before advancing, with server-side auto-check where the criterion is objectively verifiable. stepPost now requires all four checkboxes (identity_ok, academic_ok, transcript_ok, pisn_ok) before moving to the next student.

• Step 1 (Identity): identity_ok auto-checks when the optional Excel nama is present and exactly equals the PDDIKTI registered name (identity['nama_mahasiswa']).
• Step 2 (Academic): academic_ok auto-checks when the last active academic row's IPK equals the Excel IPK and its status is Aktif — recomputed in realtime in the browser (on page load, on either IPK input, and after the ENH-006 "Auto-update" button).
• Step 3 (Transcript): transcript_ok auto-checks when a thesis/skripsi course exists with a non-empty grade and choosed:true.
• Step 4 (PISN): pisn_ok stays manual only.

Every checkbox remains manually togglable regardless of the auto-check state (manual-verification design).

Also fixed (needed to surface the new validation failures): step() now reads the graduation_error flash set by stepPost, so rejected submissions show their aggregated messages instead of silently re-rendering.

Related issues

Fixes #102

Checklist

• php -l passes on all modified PHP files
• npm run build succeeds and committed assets are up to date (no asset diff)
• php spark routes shows correct new routes (no routes changed)
• vendor/bin/php-cs-fixer fix passes (no style violations)
• vendor/bin/phpunit is green (36/36)
• No debug code: dd(), var_dump(), console.log(), print_r(), exit()
• All user inputs validated server-side (all four checkbox flags in stepPost)
• All POST forms include csrf_field() (existing form unchanged)
• All HTML output uses esc()
• No unrelated files changed (ARCHITECTURE/STRUCTURE unstaged local edits excluded)
• CHANGELOG updated if this is a user-facing change
• Behaviour verified in the browser if UI changed

Screenshot (if applicable)

None attached — text verification below.

Notes for reviewers

Behaviour verified live via Playwright on NIM 202010087 (real graduation wizard session, no Neo Feeder mutation — the session was cancelled before any submission to the API):

• Student with Excel name "Test Mahasiswa" (≠ PDDIKTI "MUH ANDY RIZALDI"): step 1 identity_ok renders unchecked, step 3 transcript_ok auto-checks (thesis Skripsi exists + grade A + choosed:true), step 2 academic_ok unchecked.
• Step 2 realtime: after clicking the ENH-006 "Auto-update IPK & status ke Aktif" button, academic_ok flips to checked in the browser without a submit.
• Validation: pressing "Berikutnya" with checkboxes unchecked is rejected (stays on step) and now shows the exact aggregated messages for the unchecked steps (identity_ok, academic_ok, pisn_ok); no message for transcript_ok because it auto-checked.
• Success path: with all four checked, "Berikutnya" advances to the preview.