feat(forms): verified-email retro-link of anonymous submissions (Phase 5)

- claimMyAnonymousSubmissions(): exported but safe — no trusted params,
  resolves member + email from the caller's session, gated on
  email_confirmed_at, idempotent. Links the caller's own prior
  anonymous submissions to their member row
- hooked best-effort from joinSpace (member insert now returns id;
  links prior anon submissions for the verified email) and
  finishOnboarding
- addMember/importMembers deliberately NOT auto-linked: those emails
  are admin-asserted, not verified; the locked decision forbids
  auto-link there, so the forms.manage linkSubmissionsForMember stays
  the admin manual-link path
- also repairs a build break committed in 295d220: finishOnboarding
  declared `const admin` twice (Phase 4 added a second). The probe and
  the completion update now share one admin client
- docs: API_REFERENCE / ARCHITECTURE / HANDOFF

287/287 tests, build compiles clean (verified Compiled successfully). No deploy.

docs/ARCHITECTURE.md

@@ -422,11 +422,14 @@ forms + waivers).
 
 ### Forms & waivers (migration 026 — Phase 1: schema + RLS)
 
-`forms` and `form_submissions` back a custom form/waiver builder. Phases 1-4
-are done (schema + RLS; server actions in `lib/actions/forms.ts`; the builder
-UI under `/forms` + the public `/f/[slug]` page; onboarding `form` step type
-with required-waiver enforcement + auto-satisfy, migration 027). Automatic
-retro-linking on email verification is Phase 5. Security shape:
+`forms` and `form_submissions` back a custom form/waiver builder. The feature
+is complete (Phases 1-5): schema + RLS; server actions in
+`lib/actions/forms.ts`; the builder UI under `/forms` + the public `/f/[slug]`
+page; onboarding `form` step type with required-waiver enforcement +
+auto-satisfy (migration 027); and verified-email retro-link of anonymous
+submissions (`claimMyAnonymousSubmissions`, hooked from `joinSpace` and
+`finishOnboarding`; admin manual-link for unverified/admin-added members).
+Security shape:
 all submissions (anonymous, public-authenticated, or members) are written by a
 single validated server action using the service client AFTER server-side
 schema validation and snapshotting (same pattern as `finishOnboarding`); the