feat(forms): space-scoped public URL /f/[space]/[slug] (P6)

- migration 028: drop global UNIQUE(forms.slug), add
  UNIQUE(space_id, slug); schema.sql mirrored. Form slugs are now
  unique per space (fixes cross-tenant slug squatting)
- getPublicForm now takes { space, slug }: resolves the space by its
  slug then the form by space_id + slug (maybeSingle)
- route moved app/f/[slug] -> app/f/[space]/[slug]; the public client
  submits by formId (slug is no longer globally unambiguous) and the
  sign-in link round-trips the full /f/space/slug path
- forms-guard returns the space slug; the builder + forms list show
  the full /f/<space>/<slug> share URL; new/edit pass it through
- middleware /f allowlist already covers /f/<space>/<slug>
- getPublicFormSchema + tests updated (333 pass)

build verified (Compiled successfully, exit 0; new route present). No deploy.

scripts/028_forms_slug_per_space.sql

@@ -0,0 +1,17 @@
+-- =============================================================================
+-- 028: Form slug is unique PER SPACE, not globally
+-- =============================================================================
+-- The public form URL is moving from /f/[slug] to /f/[space]/[slug], so the
+-- form slug only needs to be unique within a space (and global uniqueness was
+-- a cross-tenant slug-squatting footgun). Drop the global UNIQUE(slug) and add
+-- UNIQUE(space_id, slug).
+--
+-- `forms_slug_key` is the auto-generated name for the inline column UNIQUE in
+-- migration 026 / schema.sql. Idempotent: DROP IF EXISTS the old and the new
+-- constraint, then ADD.
+-- =============================================================================
+
+ALTER TABLE public.forms DROP CONSTRAINT IF EXISTS forms_slug_key;
+ALTER TABLE public.forms DROP CONSTRAINT IF EXISTS forms_space_slug_key;
+ALTER TABLE public.forms
+  ADD CONSTRAINT forms_space_slug_key UNIQUE (space_id, slug);