feat(forms): delete form (confirm+cascade), delete submission, relink-all

deleteForm now permanently deletes the form AND all submissions via FK
cascade (the submissions-refusal guard is removed); requires an explicit
confirm:true (deleteFormSchema) so an accidental call cannot destroy
records, and audits the destroyed count. New deleteSubmission
(forms.manage, service client since form_submissions has no client write
policy, space-scoped, audited). New relinkAllSubmissions (forms.manage):
re-runs email->member linking space-wide, members earliest-joined first
for deterministic shared-email claim (reuses linkSubmissionsByEmail).

lib/validations.ts

@@ -677,6 +677,18 @@ export const memberSubmissionsSchema = z.object({
   memberId: z.string().uuid('Invalid member ID'),
 })
 
+// Deleting a form permanently removes it AND every submission (FK cascade),
+// including signed waivers. `confirm` must be explicitly true so an
+// accidental/stale client call cannot destroy records.
+export const deleteFormSchema = z.object({
+  formId: z.string().uuid('Invalid form ID'),
+  confirm: z.literal(true),
+})
+
+export const deleteSubmissionSchema = z.object({
+  submissionId: z.string().uuid('Invalid submission ID'),
+})
+
 export const getPublicFormSchema = z.object({
   space: z.string().min(1).max(100),
   slug: formSlug,