fix(forms): allow anonymous access to the public /f/[slug] page

The middleware PUBLIC_ROUTES allowlist did not include the public
form/waiver fill route, so unauthenticated visitors hitting
/f/<slug> were redirected to /login — making the entire public/
anonymous forms feature unreachable in production. Add '/f' to the
allowlist; only /f/[slug] lives under it (the /forms* management
routes do not match the '/f/' prefix and stay auth-gated). The page
already serves only published public forms and submitForm enforces
visibility, so this exposes nothing new.

proxy.ts

@@ -13,6 +13,11 @@ const PUBLIC_ROUTES = [
   '/signup',
   '/auth',
   '/api/health',
+  // Public form / waiver fill page. Only /f/[slug] lives here and must be
+  // reachable anonymously (the page serves only published public forms and
+  // submitForm enforces visibility). The /forms* management routes do NOT
+  // match the '/f/' prefix and stay auth-gated.
+  '/f',
   '/resources',
   '/zine',
   '/governance',