feat: configurable member onboarding + UX/persona research

A new member who joins via invite code now walks through an
admin-defined onboarding sequence before reaching the app.

Schema (migration 022, folded into schema.sql Section 14):
- space_onboarding_steps: step_key, step_type
  (welcome|code_of_conduct|profile|payment|content), title, body,
  config jsonb, is_enabled, is_required, is_system, sort_order,
  unique per (space, step_key). Full RLS: members read, admin/board
  write, admin delete non-system.
- space_members.onboarding_completed_at + onboarding_progress jsonb.
- Trigger seeds four default steps per space (welcome, code of
  conduct [required], profile, dues). Backfill seeds existing spaces
  and marks all existing members complete so the new gate never
  traps them.

Flow:
- /onboarding (top-level route, outside the (app) group so no
  redirect loop). Progress bar, step counter, back/continue, per-type
  rendering. Profile step calls updateMyProfile; payment step is a
  non-blocking nudge with optional link and "Remind me later".
- (app)/layout.tsx redirects to /onboarding while
  onboarding_completed_at is null.
- createSpace marks the founder complete: founders configure the
  space, they do not run the member flow (matches admin-vs-end-user
  persona research).
- finishOnboarding re-checks required steps server-side so a tampered
  client cannot skip a required code-of-conduct acknowledgement.
  skipOnboarding only works when nothing is required.

Admin config:
- Settings -> Onboarding tab: reorder, edit title/body/payment link,
  toggle enabled/required, add custom content steps, delete
  non-system steps.

Safety:
- components/safe-markdown.tsx renders admin-authored markdown and a
  sanitized subset of HTML (rehype-raw + rehype-sanitize). Added
  those two deps.

Also:
- bio added to updateMyProfileSchema (members can self-set it; not
  blocked by the migration-015 trigger).
- docs/UX_AND_PERSONAS.md: 4 personas and prioritized UX audit
  findings. Onboarding was finding #1; 2-6 deferred and tracked.

266/266 unit tests pass. Production build clean, /onboarding in the
route table. Migration 022 applies idempotently on the next deploy.

app/(app)/settings/page.tsx

@@ -37,6 +37,12 @@ export default async function SettingsPage() {
     .eq('space_id', member.space_id)
     .order('created_at', { ascending: false })
 
+  const { data: onboardingSteps } = await supabase
+    .from('space_onboarding_steps')
+    .select('id, step_key, step_type, title, body, config, is_enabled, is_required, is_system, sort_order')
+    .eq('space_id', member.space_id)
+    .order('sort_order', { ascending: true })
+
   const isAdmin = member?.role === 'admin'
 
   return (
@@ -74,6 +80,18 @@ export default async function SettingsPage() {
         is_enabled: boolean
         created_at: string
       }>}
+      onboardingSteps={(onboardingSteps ?? []) as Array<{
+        id: string
+        step_key: string
+        step_type: 'welcome' | 'code_of_conduct' | 'profile' | 'payment' | 'content'
+        title: string
+        body: string | null
+        config: Record<string, unknown>
+        is_enabled: boolean
+        is_required: boolean
+        is_system: boolean
+        sort_order: number
+      }>}
     />
   )
 }