feat(invites): role-granting + usage-capped invites; audit hardening (P7)

Invites
- migration 029: space_invites.role (member_role enum, default
  'member' — legacy invites and the spaces.invite_code path keep
  granting member). schema.sql + types/database.ts mirrored
- lib/invite-logic.ts (pure, tested): canAssignInviteRole — admin may
  grant any role; board may grant anything except admin; nobody else.
  Privilege-escalation guard on top of the existing admin/board gate
- createInvite/updateInvite take + enforce role via that guard;
  createInviteSchema/updateInviteSchema validate the enum
- joinSpace applies the invite's granted role (validated), default
  member; uses_count/max_uses/expiry already enforced
- invites panel: role picker (filtered to what the creator may grant),
  one-click "single use", per-invite role badge
- space-scoped invite link /join/<space>?code=… via a presentational
  app/join/[space] landing that hands off to the proven
  /signup?invite= flow; /join added to middleware PUBLIC_ROUTES

Audit hardening (from this pass's review)
- /login now honors a validated same-origin ?next= (was hardcoded to
  /dashboard) so the public_auth form sign-in round-trips; OAuth
  threads next through the callback (which already honored it)
- submitForm requires formId; submitFormSchema drops the now-ambiguous
  slug path (form slugs are per-space after 028). Both callers already
  pass formId. Tests updated

337 tests; build verified (Compiled successfully, exit 0). No deploy.

lib/actions/forms.ts

@@ -316,11 +316,11 @@ export async function submitForm(input: unknown) {
   const body = v.data
 
   const admin = createAdminClient()
-  let q = admin
+  const { data: form } = await admin
     .from('forms')
     .select('id, space_id, slug, kind, visibility, status, schema, legal_text, version')
-  q = body.formId ? q.eq('id', body.formId) : q.eq('slug', body.slug as string)
-  const { data: form } = await q.single()
+    .eq('id', body.formId)
+    .maybeSingle()
   if (!form) return { error: 'Form not found' }
   if (form.status !== 'published') {
     return { error: 'This form is not accepting responses' }