feat(forms): builder UI, management pages, and public fill page (Phase 3)

- components/forms/form-renderer.tsx: one controlled renderer for all 8
  field types, shared by the builder preview and the public page
- components/forms/form-builder.tsx: easy builder — label-only field
  creation (keys auto-derived and de-duped at save), one-click type
  buttons, up/down reordering, inline options editor, live preview;
  edit mode adds publish/close/draft/delete and copy-public-link
- /forms directory, /forms/new, /forms/[id]/edit, /forms/[id]/results
  (CSV download). Server-gated by lib/forms-guard.ts (forms.manage via
  the same RPC the RLS uses; RLS remains the real boundary)
- public app/f/[slug] (outside the app group): getPublicForm serves
  only published public forms — members-only forms are never exposed
  there; waiver consent, anon email capture, signed-in gate for
  public_auth, thank-you state
- sidebar "Forms & waivers" link; sonner toasts (codebase convention)
- ARCHITECTURE + HANDOFF updated

285/285 tests, build clean, all four routes compiled. No deploy.

app/(app)/forms/page.tsx

@@ -0,0 +1,16 @@
+import { requireFormsManagerPage } from '@/lib/forms-guard'
+import { FormsClient } from './forms-client'
+
+export const dynamic = 'force-dynamic'
+
+export default async function FormsPage() {
+  const { supabase, member } = await requireFormsManagerPage()
+
+  const { data: forms } = await supabase
+    .from('forms')
+    .select('id, slug, title, kind, visibility, status, version, created_at')
+    .eq('space_id', member.space_id)
+    .order('created_at', { ascending: false })
+
+  return <FormsClient forms={forms ?? []} />
+}