feat(forms): builder UI, management pages, and public fill page (Phase 3)

- components/forms/form-renderer.tsx: one controlled renderer for all 8
  field types, shared by the builder preview and the public page
- components/forms/form-builder.tsx: easy builder — label-only field
  creation (keys auto-derived and de-duped at save), one-click type
  buttons, up/down reordering, inline options editor, live preview;
  edit mode adds publish/close/draft/delete and copy-public-link
- /forms directory, /forms/new, /forms/[id]/edit, /forms/[id]/results
  (CSV download). Server-gated by lib/forms-guard.ts (forms.manage via
  the same RPC the RLS uses; RLS remains the real boundary)
- public app/f/[slug] (outside the app group): getPublicForm serves
  only published public forms — members-only forms are never exposed
  there; waiver consent, anon email capture, signed-in gate for
  public_auth, thank-you state
- sidebar "Forms & waivers" link; sonner toasts (codebase convention)
- ARCHITECTURE + HANDOFF updated

285/285 tests, build clean, all four routes compiled. No deploy.

app/(app)/forms/new/page.tsx

@@ -0,0 +1,30 @@
+import { requireFormsManagerPage } from '@/lib/forms-guard'
+import { PageHeader, PageTitle } from '@/components/ui/page-title'
+import { FormBuilder } from '@/components/forms/form-builder'
+
+export const dynamic = 'force-dynamic'
+
+export default async function NewFormPage() {
+  await requireFormsManagerPage()
+
+  return (
+    <>
+      <PageHeader>
+        <PageTitle>New form</PageTitle>
+      </PageHeader>
+      <div className="p-4 md:p-6">
+        <FormBuilder
+          initial={{
+            slug: '',
+            title: '',
+            description: '',
+            kind: 'form',
+            visibility: 'members',
+            legal_text: '',
+            schema: [],
+          }}
+        />
+      </div>
+    </>
+  )
+}