fix(reviews): declare auteur and status, so they are not dropped on save

lib/Settings/softwarecatalogus_register.json

@@ -4064,6 +4064,30 @@
               "handling": "related-object"
             },
             "$ref": "#/components/schemas/usage"
+          },
+          "auteur": {
+            "type": "string",
+            "description": "Display name of the submitting user. Stamped server-side by ReviewService from the authenticated Nextcloud session at submission time — a client-supplied value is always discarded and never persisted.",
+            "visible": true,
+            "facetable": false,
+            "title": "Auteur",
+            "order": 10,
+            "example": "Bijvoorbeeld: Jan Jansen"
+          },
+          "status": {
+            "type": "string",
+            "enum": [
+              "pending",
+              "approved",
+              "rejected"
+            ],
+            "default": "pending",
+            "description": "Moderation status. Every new review is forced to 'pending' server-side by ReviewService regardless of client input; only an admin approval/rejection decision (ModerationService, reusing the organisatie moderation pattern) may transition it. The public RBAC read rule below only ever matches 'approved'.",
+            "visible": true,
+            "facetable": true,
+            "title": "Status",
+            "order": 11,
+            "example": "Bijvoorbeeld: pending"
           }
         },
         "archive": [],

tests/e2e/spec-coverage/suite-wizard.spec.ts

@@ -316,7 +316,12 @@ test('suite wizard: submit creates the suite with both attached modules', async
 	// What a user DOES see on success is the navigation to the new suite's
 	// detail page, so that is asserted instead — a real, observable outcome
 	// rather than a weakened one.
-	await expect(page).toHaveURL(/#\/suites\/[^/]+$/, { timeout: 30000 })
+	// Matches the hash form AND the path form. The shell navigates to
+	// /apps/stackiq/suites/<uuid> here, with no "#", so a hash-only pattern
+	// waited the full 30s while the browser was already sitting on the right
+	// detail page. The uuid is what proves the suite was created; whether the
+	// router spells it with a hash is not what this test is about.
+	await expect(page).toHaveURL(/(?:#)?\/suites\/[^/]+$/, { timeout: 30000 })
 
 	// The suite really was persisted, with BOTH modules in `applicaties`.
 	// Read back through the register the UI wrote to.