audit: fix onboarding payment_url XSS + forum comment tenant check + joinSpace rate limit

Diversified audit across public/API, XSS/rendering, and legacy authz
surfaces (three independent reviews). No P0. Fixes:

- Onboarding payment_url (P1 stored XSS): rendered into an href with no
  protocol check; an admin could store javascript:. Sanitize at the sink
  with sanitizeUrl (http(s) only). Same class as the dues-url fix.
- forum.addComment (P2): only forum_thread targets were space-verified;
  proposal/incident/policy entity_ids were not, so a member could attach
  a comment to another space's entity. Verify the target exists in the
  caller's space (RLS-scoped) for every entity type before insert.
- joinSpace (P2): add a per-user rate limit (10/hr) for parity with
  createSpace/signIn, bounding invite-code guessing.

lib/actions/forum.ts

@@ -118,15 +118,30 @@ export async function addComment(input: {
   if (!auth.ok) return { error: auth.error }
   const { member } = auth
 
-  // Reject comments on locked forum threads up front.
+  // Verify the target entity exists IN THE CALLER'S SPACE before commenting.
+  // The RLS client scopes these reads to the caller's space, so a missing row
+  // means the entity is not in their space (or does not exist). Without this,
+  // a member could attach a comment to another space's proposal/incident/policy
+  // (the row would be stamped with the caller's own space_id). Also gates
+  // locked forum threads.
+  let entityInSpace = false
+  let threadLocked = false
   if (v.data.entity_type === 'forum_thread') {
-    const { data: thread } = await supabase
-      .from('forum_threads')
-      .select('locked')
-      .eq('id', v.data.entity_id)
-      .single()
-    if (thread?.locked) return { error: 'Thread is locked' }
+    const { data } = await supabase.from('forum_threads').select('id, locked').eq('id', v.data.entity_id).maybeSingle()
+    entityInSpace = !!data
+    threadLocked = !!data?.locked
+  } else if (v.data.entity_type === 'proposal') {
+    const { data } = await supabase.from('proposals').select('id').eq('id', v.data.entity_id).maybeSingle()
+    entityInSpace = !!data
+  } else if (v.data.entity_type === 'incident') {
+    const { data } = await supabase.from('incidents').select('id').eq('id', v.data.entity_id).maybeSingle()
+    entityInSpace = !!data
+  } else if (v.data.entity_type === 'policy') {
+    const { data } = await supabase.from('policies').select('id').eq('id', v.data.entity_id).maybeSingle()
+    entityInSpace = !!data
   }
+  if (!entityInSpace) return { error: 'Not found' }
+  if (threadLocked) return { error: 'Thread is locked' }
 
   const { data, error } = await supabase
     .from('comments')

lib/auth-actions.ts

@@ -111,6 +111,12 @@ export async function joinSpace(formData: {
   const { data: { user }, error: userErr } = await supabase.auth.getUser()
   if (userErr || !user) return { error: 'Not authenticated' }
 
+  // Throttle to bound invite-code guessing (parity with createSpace/signIn).
+  const rateLimit = checkRateLimit(`joinspace:${user.id}`, 10, 3600000) // 10 per hour
+  if (!rateLimit.allowed) {
+    return { error: 'Too many join attempts. Please try again later.' }
+  }
+
   // Use admin client for operations
   const admin = createAdminClient()