feat(forms): space-scoped public URL /f/[space]/[slug] (P6)

- migration 028: drop global UNIQUE(forms.slug), add
  UNIQUE(space_id, slug); schema.sql mirrored. Form slugs are now
  unique per space (fixes cross-tenant slug squatting)
- getPublicForm now takes { space, slug }: resolves the space by its
  slug then the form by space_id + slug (maybeSingle)
- route moved app/f/[slug] -> app/f/[space]/[slug]; the public client
  submits by formId (slug is no longer globally unambiguous) and the
  sign-in link round-trips the full /f/space/slug path
- forms-guard returns the space slug; the builder + forms list show
  the full /f/<space>/<slug> share URL; new/edit pass it through
- middleware /f allowlist already covers /f/<space>/<slug>
- getPublicFormSchema + tests updated (333 pass)

build verified (Compiled successfully, exit 0; new route present). No deploy.

lib/forms-guard.ts

@@ -15,7 +15,7 @@ export async function requireFormsManagerPage() {
 
   const { data: member } = await supabase
     .from('space_members')
-    .select('id, space_id, role, user_id, display_name')
+    .select('id, space_id, role, user_id, display_name, spaces(slug)')
     .eq('user_id', user.id)
     .in('status', ['current', 'unverified', 'late'])
     .single()
@@ -28,5 +28,6 @@ export async function requireFormsManagerPage() {
   })
   if (!allowed) redirect('/dashboard')
 
-  return { supabase, member }
+  const spaceSlug = (member.spaces as { slug?: string } | null)?.slug ?? ''
+  return { supabase, member, spaceSlug }
 }