feat(classes): optional required-form gate at signup (waiver-on-file)

Pure signupFormEligibility (manager override bypasses) + 4 tests.
signUpForClass now: classes.manage override + sign-up-on-behalf
(targetMemberId), and a hard form gate -- if the class has a
required_form_id the member must have a form_submissions row on file
(checked via service client, since a class manager need not hold
forms.manage). create/updateClass validate the form is in-space and
published. listUpcomingSessions exposes required_form {title,url,
satisfied}. Manage UI: published-form picker on create/edit + a 'requires
form' badge. Member UI: shows the requirement, links to the form, and
replaces Sign up with 'Complete required form' until it is on file.
Mirrors the equipment cert-gate pattern.

lib/validations.ts

@@ -773,6 +773,7 @@ export const createClassSchema = z.object({
   payment_link: paymentLink,
   capacity: classCapacity,
   grants_certification_id: z.string().uuid('Invalid certification ID').optional().nullable(),
+  required_form_id: z.string().uuid('Invalid form ID').optional().nullable(),
 })
 
 export const updateClassSchema = z.object({
@@ -782,6 +783,7 @@ export const updateClassSchema = z.object({
   payment_link: paymentLink,
   capacity: classCapacity,
   grants_certification_id: z.string().uuid('Invalid certification ID').optional().nullable(),
+  required_form_id: z.string().uuid('Invalid form ID').optional().nullable(),
   is_active: z.boolean().optional(),
 })
 
@@ -814,6 +816,9 @@ export const sessionIdSchema = z.object({
 
 export const signUpForClassSchema = z.object({
   sessionId: z.string().uuid('Invalid session ID'),
+  // Manager-only: sign another member up on their behalf (also bypasses the
+  // required-form gate). Ignored for non-managers.
+  memberId: z.string().uuid('Invalid member ID').optional().nullable(),
 })
 
 export const cancelSignupSchema = z.object({