feat(forms): space-scoped public URL /f/[space]/[slug] (P6)

- migration 028: drop global UNIQUE(forms.slug), add
  UNIQUE(space_id, slug); schema.sql mirrored. Form slugs are now
  unique per space (fixes cross-tenant slug squatting)
- getPublicForm now takes { space, slug }: resolves the space by its
  slug then the form by space_id + slug (maybeSingle)
- route moved app/f/[slug] -> app/f/[space]/[slug]; the public client
  submits by formId (slug is no longer globally unambiguous) and the
  sign-in link round-trips the full /f/space/slug path
- forms-guard returns the space slug; the builder + forms list show
  the full /f/<space>/<slug> share URL; new/edit pass it through
- middleware /f allowlist already covers /f/<space>/<slug>
- getPublicFormSchema + tests updated (333 pass)

build verified (Compiled successfully, exit 0; new route present). No deploy.

__tests__/forms.test.ts

@@ -184,9 +184,12 @@ describe('linkSubmissionsSchema', () => {
 })
 
 describe('getPublicFormSchema', () => {
-  it('validates the slug', () => {
-    expect(getPublicFormSchema.safeParse({ slug: 'a-form' }).success).toBe(true)
-    expect(getPublicFormSchema.safeParse({ slug: 'Bad' }).success).toBe(false)
+  it('requires both a space and a valid form slug', () => {
+    expect(getPublicFormSchema.safeParse({ space: 'heatsynclabs', slug: 'a-form' }).success).toBe(true)
+    expect(getPublicFormSchema.safeParse({ slug: 'a-form' }).success).toBe(false)
+    expect(getPublicFormSchema.safeParse({ space: 'heatsynclabs' }).success).toBe(false)
+    expect(getPublicFormSchema.safeParse({ space: 'heatsynclabs', slug: 'Bad' }).success).toBe(false)
+    expect(getPublicFormSchema.safeParse({ space: '', slug: 'a-form' }).success).toBe(false)
   })
 })