feat(forms): space-scoped public URL /f/[space]/[slug] (P6)

- migration 028: drop global UNIQUE(forms.slug), add
  UNIQUE(space_id, slug); schema.sql mirrored. Form slugs are now
  unique per space (fixes cross-tenant slug squatting)
- getPublicForm now takes { space, slug }: resolves the space by its
  slug then the form by space_id + slug (maybeSingle)
- route moved app/f/[slug] -> app/f/[space]/[slug]; the public client
  submits by formId (slug is no longer globally unambiguous) and the
  sign-in link round-trips the full /f/space/slug path
- forms-guard returns the space slug; the builder + forms list show
  the full /f/<space>/<slug> share URL; new/edit pass it through
- middleware /f allowlist already covers /f/<space>/<slug>
- getPublicFormSchema + tests updated (333 pass)

build verified (Compiled successfully, exit 0; new route present). No deploy.

app/(app)/forms/forms-client.tsx

@@ -24,7 +24,7 @@ const VIS_LABEL: Record<string, string> = {
   public_anon: 'Public',
 }
 
-export function FormsClient({ forms }: { forms: FormRow[] }) {
+export function FormsClient({ forms, spaceSlug }: { forms: FormRow[]; spaceSlug: string }) {
   return (
     <>
       <PageHeader>
@@ -65,7 +65,7 @@ export function FormsClient({ forms }: { forms: FormRow[] }) {
                     </Link>
                     {f.kind === 'waiver' && <Badge variant="secondary">Waiver</Badge>}
                   </div>
-                  <p className="font-mono text-xs text-muted-foreground">/f/{f.slug}</p>
+                  <p className="font-mono text-xs text-muted-foreground">/f/{spaceSlug}/{f.slug}</p>
                 </div>
                 <Badge variant="outline">{VIS_LABEL[f.visibility] ?? f.visibility}</Badge>
                 <Badge variant={f.status === 'published' ? 'default' : 'secondary'}>