feat(forms): space-scoped public URL /f/[space]/[slug] (P6)

- migration 028: drop global UNIQUE(forms.slug), add
  UNIQUE(space_id, slug); schema.sql mirrored. Form slugs are now
  unique per space (fixes cross-tenant slug squatting)
- getPublicForm now takes { space, slug }: resolves the space by its
  slug then the form by space_id + slug (maybeSingle)
- route moved app/f/[slug] -> app/f/[space]/[slug]; the public client
  submits by formId (slug is no longer globally unambiguous) and the
  sign-in link round-trips the full /f/space/slug path
- forms-guard returns the space slug; the builder + forms list show
  the full /f/<space>/<slug> share URL; new/edit pass it through
- middleware /f allowlist already covers /f/<space>/<slug>
- getPublicFormSchema + tests updated (333 pass)

build verified (Compiled successfully, exit 0; new route present). No deploy.

app/(app)/forms/[id]/edit/page.tsx

@@ -8,7 +8,7 @@ export const dynamic = 'force-dynamic'
 
 export default async function EditFormPage({ params }: { params: Promise<{ id: string }> }) {
   const { id } = await params
-  const { supabase, member } = await requireFormsManagerPage()
+  const { supabase, member, spaceSlug } = await requireFormsManagerPage()
 
   const { data: form } = await supabase
     .from('forms')
@@ -28,6 +28,7 @@ export default async function EditFormPage({ params }: { params: Promise<{ id: s
         <FormBuilder
           initial={{
             id: form.id,
+            spaceSlug,
             slug: form.slug,
             title: form.title,
             description: form.description ?? '',

app/(app)/forms/forms-client.tsx

@@ -24,7 +24,7 @@ const VIS_LABEL: Record<string, string> = {
   public_anon: 'Public',
 }
 
-export function FormsClient({ forms }: { forms: FormRow[] }) {
+export function FormsClient({ forms, spaceSlug }: { forms: FormRow[]; spaceSlug: string }) {
   return (
     <>
       <PageHeader>
@@ -65,7 +65,7 @@ export function FormsClient({ forms }: { forms: FormRow[] }) {
                     </Link>
                     {f.kind === 'waiver' && <Badge variant="secondary">Waiver</Badge>}
                   </div>
-                  <p className="font-mono text-xs text-muted-foreground">/f/{f.slug}</p>
+                  <p className="font-mono text-xs text-muted-foreground">/f/{spaceSlug}/{f.slug}</p>
                 </div>
                 <Badge variant="outline">{VIS_LABEL[f.visibility] ?? f.visibility}</Badge>
                 <Badge variant={f.status === 'published' ? 'default' : 'secondary'}>

app/(app)/forms/new/page.tsx

@@ -5,7 +5,7 @@ import { FormBuilder } from '@/components/forms/form-builder'
 export const dynamic = 'force-dynamic'
 
 export default async function NewFormPage() {
-  await requireFormsManagerPage()
+  const { spaceSlug } = await requireFormsManagerPage()
 
   return (
     <>
@@ -15,6 +15,7 @@ export default async function NewFormPage() {
       <div className="p-4 md:p-6">
         <FormBuilder
           initial={{
+            spaceSlug,
             slug: '',
             title: '',
             description: '',

app/(app)/forms/page.tsx

@@ -4,7 +4,7 @@ import { FormsClient } from './forms-client'
 export const dynamic = 'force-dynamic'
 
 export default async function FormsPage() {
-  const { supabase, member } = await requireFormsManagerPage()
+  const { supabase, member, spaceSlug } = await requireFormsManagerPage()
 
   const { data: forms } = await supabase
     .from('forms')
@@ -12,5 +12,5 @@ export default async function FormsPage() {
     .eq('space_id', member.space_id)
     .order('created_at', { ascending: false })
 
-  return <FormsClient forms={forms ?? []} />
+  return <FormsClient forms={forms ?? []} spaceSlug={spaceSlug} />
 }

app/f/[space]/[slug]/page.tsx

@@ -5,9 +5,13 @@ import { PublicFormClient } from './public-form-client'
 
 export const dynamic = 'force-dynamic'
 
-export default async function PublicFormPage({ params }: { params: Promise<{ slug: string }> }) {
-  const { slug } = await params
-  const res = await getPublicForm({ slug })
+export default async function PublicFormPage({
+  params,
+}: {
+  params: Promise<{ space: string; slug: string }>
+}) {
+  const { space, slug } = await params
+  const res = await getPublicForm({ space, slug })
 
   if ('error' in res && res.error) {
     return (
@@ -29,7 +33,8 @@ export default async function PublicFormPage({ params }: { params: Promise<{ slu
   return (
     <main className="mx-auto max-w-2xl p-4 md:p-8">
       <PublicFormClient
-        slug={form.slug}
+        formId={form.id}
+        nextPath={`/f/${space}/${slug}`}
         title={form.title}
         description={form.description}
         kind={form.kind}

app/f/[space]/[slug]/public-form-client.tsx

@@ -9,7 +9,8 @@ import { submitForm } from '@/lib/actions'
 import type { FormField } from '@/lib/forms-schema'
 
 export function PublicFormClient({
-  slug,
+  formId,
+  nextPath,
   title,
   description,
   kind,
@@ -18,7 +19,8 @@ export function PublicFormClient({
   fields,
   authed,
 }: {
-  slug: string
+  formId: string
+  nextPath: string
   title: string
   description: string | null
   kind: string
@@ -41,8 +43,10 @@ export function PublicFormClient({
   async function submit() {
     setError(null)
     setSubmitting(true)
+    // Submit by formId: form slugs are only unique per space now, so id is
+    // the unambiguous handle.
     const res = await submitForm({
-      slug,
+      formId,
       answers: values,
       email: showEmail && email ? email : undefined,
       consent: isWaiver ? consent : undefined,
@@ -75,7 +79,7 @@ export function PublicFormClient({
         <div className="rounded-lg border bg-muted/40 p-6 text-center">
           <p className="text-sm">You need to be signed in to submit this form.</p>
           <Button asChild className="mt-3">
-            <a href={`/login?next=/f/${slug}`}>Sign in</a>
+            <a href={`/login?next=${encodeURIComponent(nextPath)}`}>Sign in</a>
           </Button>
         </div>
       ) : (