feat(forms): space-scoped public URL /f/[space]/[slug] (P6)

- migration 028: drop global UNIQUE(forms.slug), add
  UNIQUE(space_id, slug); schema.sql mirrored. Form slugs are now
  unique per space (fixes cross-tenant slug squatting)
- getPublicForm now takes { space, slug }: resolves the space by its
  slug then the form by space_id + slug (maybeSingle)
- route moved app/f/[slug] -> app/f/[space]/[slug]; the public client
  submits by formId (slug is no longer globally unambiguous) and the
  sign-in link round-trips the full /f/space/slug path
- forms-guard returns the space slug; the builder + forms list show
  the full /f/<space>/<slug> share URL; new/edit pass it through
- middleware /f allowlist already covers /f/<space>/<slug>
- getPublicFormSchema + tests updated (333 pass)

build verified (Compiled successfully, exit 0; new route present). No deploy.

lib/actions/forms.ts

@@ -395,11 +395,19 @@ export async function getPublicForm(input: unknown) {
   if (!v.ok) return { error: v.error }
 
   const admin = createAdminClient()
+  const { data: space } = await admin
+    .from('spaces')
+    .select('id')
+    .eq('slug', v.data.space)
+    .maybeSingle()
+  if (!space) return { error: 'This form is not available.' }
+
   const { data: form } = await admin
     .from('forms')
     .select('id, slug, title, description, kind, visibility, schema, legal_text, version, status')
+    .eq('space_id', space.id)
     .eq('slug', v.data.slug)
-    .single()
+    .maybeSingle()
 
   // Members-only forms are never served on the public page (that would expose
   // their schema to anyone). They are filled from inside the app.

lib/forms-guard.ts

@@ -15,7 +15,7 @@ export async function requireFormsManagerPage() {
 
   const { data: member } = await supabase
     .from('space_members')
-    .select('id, space_id, role, user_id, display_name')
+    .select('id, space_id, role, user_id, display_name, spaces(slug)')
     .eq('user_id', user.id)
     .in('status', ['current', 'unverified', 'late'])
     .single()
@@ -28,5 +28,6 @@ export async function requireFormsManagerPage() {
   })
   if (!allowed) redirect('/dashboard')
 
-  return { supabase, member }
+  const spaceSlug = (member.spaces as { slug?: string } | null)?.slug ?? ''
+  return { supabase, member, spaceSlug }
 }

lib/validations.ts

@@ -666,7 +666,10 @@ export const linkSubmissionsSchema = z.object({
   email: emailField(),
 })
 
-export const getPublicFormSchema = z.object({ slug: formSlug })
+export const getPublicFormSchema = z.object({
+  space: z.string().min(1).max(100),
+  slug: formSlug,
+})
 
 // ─── Generic ID schemas ──────────────────────────────────────────────────────