refactor observers, fix policy, add feature tests

app/Observers/ActivityObserver.php

@@ -12,25 +12,36 @@ use Illuminate\Support\Facades\Auth;
 
 class ActivityObserver
 {
-    public function updated(Activity $activity): void
+    public function updating(Activity $activity): bool
     {
-        if ($activity->wasChanged('status')) {
+        if ($activity->isDirty('status')) {
             $old = $activity->getOriginal('status');
             $new = $activity->status;
 
-            // Validasi workflow: draft→pending, pending→approved/rejected
             $allowed = [
                 'draft'   => ['pending'],
                 'pending' => ['approved', 'rejected'],
             ];
 
-            if (isset($allowed[$old]) && ! in_array($new, $allowed[$old])) {
+            $validTransition = isset($allowed[$old]) && in_array($new, $allowed[$old]);
+
+            if (! $validTransition) {
                 Notification::make()->title('Transisi tidak diizinkan')
                     ->body("Status tidak bisa diubah dari {$old} ke {$new}.")
                     ->danger()->send();
-                $activity->status = $old;
-                return;
+
+                return false; // batalkan save
             }
+        }
+
+        return true;
+    }
+
+    public function updated(Activity $activity): void
+    {
+        if ($activity->wasChanged('status')) {
+            $old = $activity->getOriginal('status');
+            $new = $activity->status;
 
             ActivityLog::create([
                 'user_id'     => Auth::id(),