feat(forms): builder UI, management pages, and public fill page (Phase 3)

- components/forms/form-renderer.tsx: one controlled renderer for all 8
  field types, shared by the builder preview and the public page
- components/forms/form-builder.tsx: easy builder — label-only field
  creation (keys auto-derived and de-duped at save), one-click type
  buttons, up/down reordering, inline options editor, live preview;
  edit mode adds publish/close/draft/delete and copy-public-link
- /forms directory, /forms/new, /forms/[id]/edit, /forms/[id]/results
  (CSV download). Server-gated by lib/forms-guard.ts (forms.manage via
  the same RPC the RLS uses; RLS remains the real boundary)
- public app/f/[slug] (outside the app group): getPublicForm serves
  only published public forms — members-only forms are never exposed
  there; waiver consent, anon email capture, signed-in gate for
  public_auth, thank-you state
- sidebar "Forms & waivers" link; sonner toasts (codebase convention)
- ARCHITECTURE + HANDOFF updated

285/285 tests, build clean, all four routes compiled. No deploy.

app/f/[slug]/page.tsx

@@ -0,0 +1,43 @@
+import { createClient } from '@/lib/supabase/server'
+import { getPublicForm } from '@/lib/actions'
+import { parseFormSchema } from '@/lib/forms-schema'
+import { PublicFormClient } from './public-form-client'
+
+export const dynamic = 'force-dynamic'
+
+export default async function PublicFormPage({ params }: { params: Promise<{ slug: string }> }) {
+  const { slug } = await params
+  const res = await getPublicForm({ slug })
+
+  if ('error' in res && res.error) {
+    return (
+      <main className="mx-auto flex min-h-screen max-w-xl flex-col items-center justify-center p-6 text-center">
+        <h1 className="text-xl font-semibold">This form is not available</h1>
+        <p className="mt-2 text-sm text-muted-foreground">
+          It may be unpublished, closed, or the link is wrong.
+        </p>
+      </main>
+    )
+  }
+
+  const form = res.data
+  const supabase = await createClient()
+  const {
+    data: { user },
+  } = await supabase.auth.getUser()
+
+  return (
+    <main className="mx-auto max-w-2xl p-4 md:p-8">
+      <PublicFormClient
+        slug={form.slug}
+        title={form.title}
+        description={form.description}
+        kind={form.kind}
+        visibility={form.visibility}
+        legalText={form.legal_text}
+        fields={parseFormSchema(form.schema)}
+        authed={Boolean(user)}
+      />
+    </main>
+  )
+}