fix(promo-codes): address CodeRabbit findings on saga reorder

- Critical: ReserveOrderTask::run now returns the accumulated formerState
  instead of a fresh ['order' => ...] array. After the reorder, ApplyPromoCodeTask
  runs downstream and reads promo_codes_usage / reservations / ticket_types_ids
  that earlier tasks populated; dropping state broke promo redemption and
  per-account enforcement for every promo-code checkout.
- Minor: discover() OpenAPI security annotation now declares both
  ReadSummitData and ReadAllSummitData to match the seeded scopes.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: caseylocker

app/Http/Controllers/Apis/Protected/Summit/OAuth2SummitPromoCodesApiController.php

@@ -1588,7 +1588,7 @@ public function sendSponsorPromoCodes($summit_id)
         description: "Returns domain-authorized promo codes (matched by email domain) and existing email-linked promo codes (member/speaker, matched by associated email) for the current user",
         operationId: "discoverPromoCodesBySummit",
         tags: ["Promo Codes"],
-        security: [['summit_promo_codes_oauth2' => [SummitScopes::ReadSummitData]]],
+        security: [['summit_promo_codes_oauth2' => [SummitScopes::ReadSummitData, SummitScopes::ReadAllSummitData]]],
         parameters: [
             new OA\Parameter(name: "id", in: "path", required: true, schema: new OA\Schema(type: "integer")),
             new OA\Parameter(name: "expand", in: "query", required: false, schema: new OA\Schema(type: "string")),

app/Services/Model/Imp/SummitOrderService.php

@@ -664,7 +664,10 @@ public function run(array $formerState): array
                 $invitation->addOrder($order);
             }
             $this->formerState['order'] = $order;
-            return ['order' => $order];
+            // Preserve accumulated state (promo_codes_usage, reservations, etc.) so
+            // ApplyPromoCodeTask — which now runs after ReserveOrderTask — can read
+            // the state populated by PreProcessReservationTask.
+            return $this->formerState;
         });
     }