feat(forms): schema + RLS for custom forms and waivers (Phase 1)

Adds the forms and form_submissions tables behind a custom form/waiver
builder. Phase 1 is schema + RLS only; server actions, builder UI, the
public /f/[slug] page, onboarding integration, and retro-linking follow
in later phases.

- scripts/026_forms.sql (idempotent), mirrored as schema.sql Section 17
- forms: globally-unique slug, kind (form/waiver), visibility
  (public_anon/public_auth/members), status, jsonb field schema,
  legal_text, version
- form_submissions: per-row snapshot of schema/legal-text/version for
  immutable waiver records, plus ip/user_agent for e-sign defensibility
- RLS additive + default-deny: forms write gated by forms.manage via
  user_has_permission; form_submissions has no write policy, so it is
  service-client-only and immutable; anon gets no grant on forms
- new forms.manage permission seeded to board + backfilled
- types/database.ts and DATABASE_SCHEMA/DB_SCHEMA_MAP/ARCHITECTURE/HANDOFF
  updated

lib/permissions-catalog.ts

@@ -21,6 +21,7 @@ export const PERMISSIONS = [
   { code: 'payments.manage',    group: 'Finance', label: 'Manage payments' },
   { code: 'governance.manage',  group: 'Governance', label: 'Manage proposals, incidents, policies' },
   { code: 'forum.moderate',     group: 'Community', label: 'Moderate forum and comments' },
+  { code: 'forms.manage',       group: 'Community', label: 'Manage forms and waivers' },
   { code: 'customize.manage',   group: 'Admin', label: 'Customize roles, tiers, areas, invites, onboarding' },
   { code: 'settings.manage',    group: 'Admin', label: 'Space settings, integrations, webhooks' },
 ] as const
@@ -39,7 +40,7 @@ export const DEFAULT_ROLE_PERMISSIONS: Record<string, PermissionCode[]> = {
     'ops.kb.read', 'ops.kb.write', 'ops.process.read', 'ops.process.write',
     'ops.secrets.read', 'ops.secrets.write', 'ops.arealeads.manage',
     'members.manage', 'payments.manage', 'governance.manage',
-    'forum.moderate', 'customize.manage', 'settings.manage',
+    'forum.moderate', 'forms.manage', 'customize.manage', 'settings.manage',
   ],
   treasurer: ['payments.manage', 'ops.kb.read', 'ops.process.read'],
   member: ['ops.kb.read', 'ops.process.read'],