Fix form submit endpoint to always return Form entity, not success handler result

The submit endpoint was replacing its Form response with the success
handler's result (e.g. the created User on registration). This produced
inconsistent @type/@id when the form handler returned a non-Form entity.

Now only Response objects (e.g. 404 from PasswordUpdateListener) replace
the Form result — entity results are side-effects and the Form is always
returned. Registration test updated to validate the Form schema instead of
expecting a User entity in the response.

Author: silverbackdan

features/user/register_form.feature

@@ -27,19 +27,7 @@ Feature: Register process via a form
     And the response status code should be 201
     And the response should be in JSON
     And the header "Content-Type" should be equal to "application/ld+json; charset=utf-8"
-    And the JSON should be a superset of:
-    """
-    {
-        "@context": "/contexts/User",
-        "@type": "User",
-        "username": "new_user",
-        "emailAddress": "user@example.com",
-        "_metadata": {
-          "persisted": true
-        }
-    }
-    """
-    And the JSON should be valid according to the schema file "user.schema.json"
+    And the JSON should be valid according to the schema file "form.schema.json"
     And I should get a "user_welcome" email sent
 
   Scenario Outline: Submit a duplicate user registration form

src/EventListener/Api/FormApiEventListener.php

@@ -68,10 +68,11 @@ private function handleFormData(ViewEvent $event): void
 
         if ($data->formView->getForm()->isValid()) {
             $result = $this->formSubmitHelper->handleSuccess($data);
-            if ($result) {
-                // we were going to do sub-requests, but then we may require authorization and for forms we shouldn't need that
-                // instead Form:component:read serialization group should be added to properties of objects being returned
-                // for them to be serialized in the result
+            // Only replace the Form with the result if it is an explicit Response object
+            // (e.g. a 404 from PasswordUpdateListener). Entity results (e.g. the created User
+            // from registration) are intentionally ignored — the submit endpoint always returns
+            // the Form entity so @type and @id remain stable regardless of side-effects.
+            if ($result instanceof Response) {
                 $data = $result;
             }
         }