feat(forms): onboarding form/waiver step with required enforcement (Phase 4)

- scripts/027 (idempotent CHECK replace) + schema.sql Section 14: allow
  space_onboarding_steps.step_type = 'form'; referenced form id lives in
  the step's existing config.form_id (no new column)
- finishOnboarding: a required form step is satisfied when a submission
  for config.form_id by the member exists (any version — re-sign is
  non-blocking / auto-satisfy); fails open if the form is missing or
  unpublished so a misconfig cannot trap a member. Probe uses the
  service client (submissions are forms.manage-only under RLS)
- onboarding page enriches form steps with the published form def +
  prior-submission flag; onboarding-flow renders FormRenderer + waiver
  legal text/consent and submits via submitForm then marks the step done
- customize: forms fetched and threaded to the onboarding panel; new
  "+ Form step" button + form picker writing config.form_id
- validations/types/casts include 'form'; forms.test.ts +2
- docs: DATABASE_SCHEMA/DB_SCHEMA_MAP/API_REFERENCE/ARCHITECTURE/HANDOFF

287/287 tests, build exit 0. No deploy.

scripts/027_onboarding_form_step.sql

@@ -0,0 +1,20 @@
+-- =============================================================================
+-- 027: Allow an onboarding step to embed a custom form / waiver
+-- =============================================================================
+-- Adds 'form' to the space_onboarding_steps.step_type CHECK so a space can
+-- require a custom form or waiver as an onboarding step. The referenced form
+-- is stored in the step's existing `config` jsonb as { "form_id": "<uuid>" };
+-- no new column is needed.
+--
+-- step_type is a TEXT column with a column-level CHECK, not a Postgres enum,
+-- so this is a constraint replacement (the only safe path for a CHECK), done
+-- by the auto-generated constraint name. Idempotent: DROP CONSTRAINT IF EXISTS
+-- then ADD.
+-- =============================================================================
+
+ALTER TABLE public.space_onboarding_steps
+  DROP CONSTRAINT IF EXISTS space_onboarding_steps_step_type_check;
+
+ALTER TABLE public.space_onboarding_steps
+  ADD CONSTRAINT space_onboarding_steps_step_type_check
+  CHECK (step_type IN ('welcome','code_of_conduct','profile','payment','content','form'));

scripts/schema.sql

@@ -1628,7 +1628,7 @@ CREATE TABLE IF NOT EXISTS public.space_onboarding_steps (
   id          uuid        PRIMARY KEY DEFAULT uuid_generate_v4(),
   space_id    uuid        NOT NULL REFERENCES public.spaces(id) ON DELETE CASCADE,
   step_key    text        NOT NULL CHECK (char_length(step_key) BETWEEN 1 AND 60),
-  step_type   text        NOT NULL CHECK (step_type IN ('welcome','code_of_conduct','profile','payment','content')),
+  step_type   text        NOT NULL CHECK (step_type IN ('welcome','code_of_conduct','profile','payment','content','form')),
   title       text        NOT NULL CHECK (char_length(title) BETWEEN 1 AND 200),
   body        text,
   config      jsonb       NOT NULL DEFAULT '{}',