feat(invites): role-granting + usage-capped invites; audit hardening (P7)

Invites
- migration 029: space_invites.role (member_role enum, default
  'member' — legacy invites and the spaces.invite_code path keep
  granting member). schema.sql + types/database.ts mirrored
- lib/invite-logic.ts (pure, tested): canAssignInviteRole — admin may
  grant any role; board may grant anything except admin; nobody else.
  Privilege-escalation guard on top of the existing admin/board gate
- createInvite/updateInvite take + enforce role via that guard;
  createInviteSchema/updateInviteSchema validate the enum
- joinSpace applies the invite's granted role (validated), default
  member; uses_count/max_uses/expiry already enforced
- invites panel: role picker (filtered to what the creator may grant),
  one-click "single use", per-invite role badge
- space-scoped invite link /join/<space>?code=… via a presentational
  app/join/[space] landing that hands off to the proven
  /signup?invite= flow; /join added to middleware PUBLIC_ROUTES

Audit hardening (from this pass's review)
- /login now honors a validated same-origin ?next= (was hardcoded to
  /dashboard) so the public_auth form sign-in round-trips; OAuth
  threads next through the callback (which already honored it)
- submitForm requires formId; submitFormSchema drops the now-ambiguous
  slug path (form slugs are per-space after 028). Both callers already
  pass formId. Tests updated

337 tests; build verified (Compiled successfully, exit 0). No deploy.

lib/auth-actions.ts

@@ -117,10 +117,10 @@ export async function joinSpace(formData: {
 
   // Try the new multi-code invites table first. Falls back to the legacy
   // spaces.invite_code (a permanent default) if the code isn't found there.
-  let invite: { id: string; space_id: string; max_uses: number | null; uses_count: number; expires_at: string | null; is_enabled: boolean } | null = null
+  let invite: { id: string; space_id: string; max_uses: number | null; uses_count: number; expires_at: string | null; is_enabled: boolean; role: string } | null = null
   const { data: inviteRow } = await admin
     .from('space_invites')
-    .select('id, space_id, max_uses, uses_count, expires_at, is_enabled')
+    .select('id, space_id, max_uses, uses_count, expires_at, is_enabled, role')
     .eq('code', code)
     .maybeSingle()
   if (inviteRow) invite = inviteRow as typeof invite
@@ -149,6 +149,14 @@ export async function joinSpace(formData: {
 
   if (lookupErr || !space) return { error: 'Invalid invite code' }
 
+  // Honor the invite's granted role (default 'member' for the legacy
+  // spaces.invite_code path or any invite created before migration 029).
+  // Validated against the enum defensively even though the DB constrains it.
+  const grantedRole =
+    invite && ['admin', 'board', 'treasurer', 'member', 'associate'].includes(invite.role)
+      ? invite.role
+      : 'member'
+
   const { data: newMember, error: memberErr } = await admin
     .from('space_members')
     .insert({
@@ -156,7 +164,7 @@ export async function joinSpace(formData: {
       user_id: user.id,
       display_name: formData.displayName || user.email,
       email: user.email,
-      role: 'member',
+      role: grantedRole,
       tier: 'basic',
       status: space.require_approval ? 'unverified' : 'current',
       approved: true,