feat(forms): space-scoped public URL /f/[space]/[slug] (P6)

- migration 028: drop global UNIQUE(forms.slug), add
  UNIQUE(space_id, slug); schema.sql mirrored. Form slugs are now
  unique per space (fixes cross-tenant slug squatting)
- getPublicForm now takes { space, slug }: resolves the space by its
  slug then the form by space_id + slug (maybeSingle)
- route moved app/f/[slug] -> app/f/[space]/[slug]; the public client
  submits by formId (slug is no longer globally unambiguous) and the
  sign-in link round-trips the full /f/space/slug path
- forms-guard returns the space slug; the builder + forms list show
  the full /f/<space>/<slug> share URL; new/edit pass it through
- middleware /f allowlist already covers /f/<space>/<slug>
- getPublicFormSchema + tests updated (333 pass)

build verified (Compiled successfully, exit 0; new route present). No deploy.

app/f/[space]/[slug]/page.tsx

@@ -0,0 +1,48 @@
+import { createClient } from '@/lib/supabase/server'
+import { getPublicForm } from '@/lib/actions'
+import { parseFormSchema } from '@/lib/forms-schema'
+import { PublicFormClient } from './public-form-client'
+
+export const dynamic = 'force-dynamic'
+
+export default async function PublicFormPage({
+  params,
+}: {
+  params: Promise<{ space: string; slug: string }>
+}) {
+  const { space, slug } = await params
+  const res = await getPublicForm({ space, slug })
+
+  if ('error' in res && res.error) {
+    return (
+      <main className="mx-auto flex min-h-screen max-w-xl flex-col items-center justify-center p-6 text-center">
+        <h1 className="text-xl font-semibold">This form is not available</h1>
+        <p className="mt-2 text-sm text-muted-foreground">
+          It may be unpublished, closed, or the link is wrong.
+        </p>
+      </main>
+    )
+  }
+
+  const form = res.data
+  const supabase = await createClient()
+  const {
+    data: { user },
+  } = await supabase.auth.getUser()
+
+  return (
+    <main className="mx-auto max-w-2xl p-4 md:p-8">
+      <PublicFormClient
+        formId={form.id}
+        nextPath={`/f/${space}/${slug}`}
+        title={form.title}
+        description={form.description}
+        kind={form.kind}
+        visibility={form.visibility}
+        legalText={form.legal_text}
+        fields={parseFormSchema(form.schema)}
+        authed={Boolean(user)}
+      />
+    </main>
+  )
+}