feat: configurable member onboarding + UX/persona research

A new member who joins via invite code now walks through an
admin-defined onboarding sequence before reaching the app.

Schema (migration 022, folded into schema.sql Section 14):
- space_onboarding_steps: step_key, step_type
  (welcome|code_of_conduct|profile|payment|content), title, body,
  config jsonb, is_enabled, is_required, is_system, sort_order,
  unique per (space, step_key). Full RLS: members read, admin/board
  write, admin delete non-system.
- space_members.onboarding_completed_at + onboarding_progress jsonb.
- Trigger seeds four default steps per space (welcome, code of
  conduct [required], profile, dues). Backfill seeds existing spaces
  and marks all existing members complete so the new gate never
  traps them.

Flow:
- /onboarding (top-level route, outside the (app) group so no
  redirect loop). Progress bar, step counter, back/continue, per-type
  rendering. Profile step calls updateMyProfile; payment step is a
  non-blocking nudge with optional link and "Remind me later".
- (app)/layout.tsx redirects to /onboarding while
  onboarding_completed_at is null.
- createSpace marks the founder complete: founders configure the
  space, they do not run the member flow (matches admin-vs-end-user
  persona research).
- finishOnboarding re-checks required steps server-side so a tampered
  client cannot skip a required code-of-conduct acknowledgement.
  skipOnboarding only works when nothing is required.

Admin config:
- Settings -> Onboarding tab: reorder, edit title/body/payment link,
  toggle enabled/required, add custom content steps, delete
  non-system steps.

Safety:
- components/safe-markdown.tsx renders admin-authored markdown and a
  sanitized subset of HTML (rehype-raw + rehype-sanitize). Added
  those two deps.

Also:
- bio added to updateMyProfileSchema (members can self-set it; not
  blocked by the migration-015 trigger).
- docs/UX_AND_PERSONAS.md: 4 personas and prioritized UX audit
  findings. Onboarding was finding #1; 2-6 deferred and tracked.

266/266 unit tests pass. Production build clean, /onboarding in the
route table. Migration 022 applies idempotently on the next deploy.

lib/validations.ts

@@ -318,11 +318,35 @@ export const updateMyProfileSchema = z.object({
   display_name: z.string().min(1).max(100).optional(),
   handle: z.string().max(50).optional().nullable(),
   phone: z.string().max(20).optional().nullable(),
+  bio: z.string().max(2000).optional().nullable(),
   skills: z.array(z.string().min(1).max(60)).max(40).optional(),
   interests: z.array(z.string().min(1).max(60)).max(40).optional(),
   willing_to: z.array(z.string().min(1).max(60)).max(20).optional(),
 })
 
+// ─── Onboarding ──────────────────────────────────────────────────────────────
+
+export const onboardingStepTypeSchema = z.enum(['welcome', 'code_of_conduct', 'profile', 'payment', 'content'])
+
+export const createOnboardingStepSchema = z.object({
+  step_type: onboardingStepTypeSchema,
+  title: z.string().min(1, 'Title is required').max(200),
+  body: z.string().max(50000).optional().nullable(),
+  config: z.record(z.unknown()).optional(),
+  is_enabled: z.boolean().optional(),
+  is_required: z.boolean().optional(),
+  sort_order: z.number().int().min(0).max(100000).optional(),
+})
+
+export const updateOnboardingStepSchema = z.object({
+  title: z.string().min(1).max(200).optional(),
+  body: z.string().max(50000).optional().nullable(),
+  config: z.record(z.unknown()).optional(),
+  is_enabled: z.boolean().optional(),
+  is_required: z.boolean().optional(),
+  sort_order: z.number().int().min(0).max(100000).optional(),
+})
+
 export const discloseAffiliationsSchema = z.object({
   affiliations: z.array(z.string().min(1).max(200)).max(50).default([]),
 })