two type hints introduced earlier on this branch referenced
classes by their fully-qualified names inline. hoist them to
the top-of-file use block per backend-context.md PHP rules.
add failing tests for getMyTexts (own-only), getAllTexts
(admin), getText 403 for non-owner, and admin bypass on
getText. existing test_get_one_text updated to pass the
session user via the new request signature.
cover that the created Text carries the supplied User, that
the controller persists the user from the session attribute,
and that any userId in the request body is ignored.
