feat(forms): builder UI, management pages, and public fill page (Phase 3)

- components/forms/form-renderer.tsx: one controlled renderer for all 8
  field types, shared by the builder preview and the public page
- components/forms/form-builder.tsx: easy builder — label-only field
  creation (keys auto-derived and de-duped at save), one-click type
  buttons, up/down reordering, inline options editor, live preview;
  edit mode adds publish/close/draft/delete and copy-public-link
- /forms directory, /forms/new, /forms/[id]/edit, /forms/[id]/results
  (CSV download). Server-gated by lib/forms-guard.ts (forms.manage via
  the same RPC the RLS uses; RLS remains the real boundary)
- public app/f/[slug] (outside the app group): getPublicForm serves
  only published public forms — members-only forms are never exposed
  there; waiver consent, anon email capture, signed-in gate for
  public_auth, thank-you state
- sidebar "Forms & waivers" link; sonner toasts (codebase convention)
- ARCHITECTURE + HANDOFF updated

285/285 tests, build clean, all four routes compiled. No deploy.

lib/actions/forms.ts

@@ -19,6 +19,7 @@ import {
   formIdSchema,
   submitFormSchema,
   linkSubmissionsSchema,
+  getPublicFormSchema,
 } from '@/lib/validations'
 import { parseFormSchema, validateAnswers } from '@/lib/forms-schema'
 
@@ -393,6 +394,29 @@ export async function submitForm(input: unknown) {
   return { success: true as const }
 }
 
+/**
+ * Public read for the /f/[slug] page. Service client (anon has no grant on
+ * `forms`). Returns only a published form and only public-safe columns.
+ */
+export async function getPublicForm(input: unknown) {
+  const v = parseInput(getPublicFormSchema, input)
+  if (!v.ok) return { error: v.error }
+
+  const admin = createAdminClient()
+  const { data: form } = await admin
+    .from('forms')
+    .select('id, slug, title, description, kind, visibility, schema, legal_text, version, status')
+    .eq('slug', v.data.slug)
+    .single()
+
+  // Members-only forms are never served on the public page (that would expose
+  // their schema to anyone). They are filled from inside the app.
+  if (!form || form.status !== 'published' || form.visibility === 'members') {
+    return { error: 'This form is not available.' }
+  }
+  return { data: form }
+}
+
 /**
  * Retro-link prior anonymous submissions to a member by matching email.
  *

lib/forms-guard.ts

@@ -0,0 +1,32 @@
+import { redirect } from 'next/navigation'
+import { createClient } from '@/lib/supabase/server'
+
+// Server-component guard for the /forms management pages. Mirrors the
+// /settings server gate: resolve the member, check forms.manage via the
+// same RPC the forms RLS uses, and redirect non-managers before any data
+// is fetched. The forms RLS independently enforces this; the redirect is
+// for UX, not the security boundary.
+export async function requireFormsManagerPage() {
+  const supabase = await createClient()
+  const {
+    data: { user },
+  } = await supabase.auth.getUser()
+  if (!user) redirect('/login')
+
+  const { data: member } = await supabase
+    .from('space_members')
+    .select('id, space_id, role, user_id, display_name')
+    .eq('user_id', user.id)
+    .in('status', ['current', 'unverified', 'late'])
+    .single()
+  if (!member) redirect('/login')
+
+  const { data: allowed } = await supabase.rpc('user_has_permission', {
+    uid: user.id,
+    sid: member.space_id,
+    perm: 'forms.manage',
+  })
+  if (!allowed) redirect('/dashboard')
+
+  return { supabase, member }
+}

lib/validations.ts

@@ -569,7 +569,7 @@ export const formKinds = ['form', 'waiver'] as const
 export const formVisibilities = ['public_anon', 'public_auth', 'members'] as const
 export const formStatuses = ['draft', 'published', 'closed'] as const
 
-const formSlug = z
+export const formSlug = z
   .string()
   .min(1, 'Slug is required')
   .max(80, 'Slug must be 80 characters or fewer')
@@ -666,6 +666,8 @@ export const linkSubmissionsSchema = z.object({
   email: emailField(),
 })
 
+export const getPublicFormSchema = z.object({ slug: formSlug })
+
 // ─── Generic ID schemas ──────────────────────────────────────────────────────
 
 export const uuidSchema = z.string().uuid('Invalid ID format')