feat(invites): role-granting + usage-capped invites; audit hardening (P7)

Invites
- migration 029: space_invites.role (member_role enum, default
  'member' — legacy invites and the spaces.invite_code path keep
  granting member). schema.sql + types/database.ts mirrored
- lib/invite-logic.ts (pure, tested): canAssignInviteRole — admin may
  grant any role; board may grant anything except admin; nobody else.
  Privilege-escalation guard on top of the existing admin/board gate
- createInvite/updateInvite take + enforce role via that guard;
  createInviteSchema/updateInviteSchema validate the enum
- joinSpace applies the invite's granted role (validated), default
  member; uses_count/max_uses/expiry already enforced
- invites panel: role picker (filtered to what the creator may grant),
  one-click "single use", per-invite role badge
- space-scoped invite link /join/<space>?code=… via a presentational
  app/join/[space] landing that hands off to the proven
  /signup?invite= flow; /join added to middleware PUBLIC_ROUTES

Audit hardening (from this pass's review)
- /login now honors a validated same-origin ?next= (was hardcoded to
  /dashboard) so the public_auth form sign-in round-trips; OAuth
  threads next through the callback (which already honored it)
- submitForm requires formId; submitFormSchema drops the now-ambiguous
  slug path (form slugs are per-space after 028). Both callers already
  pass formId. Tests updated

337 tests; build verified (Compiled successfully, exit 0). No deploy.

lib/actions/invites.ts

@@ -4,6 +4,7 @@ import { revalidatePath } from 'next/cache'
 import { createClient } from '@/lib/supabase/server'
 import { requireMemberWithRole, parseInput } from '@/lib/auth-helpers'
 import { createInviteSchema, updateInviteSchema, uuidSchema } from '@/lib/validations'
+import { canAssignInviteRole } from '@/lib/invite-logic'
 
 const INVITE_ADMIN_ROLES = ['admin', 'board'] as const
 
@@ -22,6 +23,7 @@ export async function createInvite(input: {
   expires_at?: string | null
   max_uses?: number | null
   is_enabled?: boolean
+  role?: 'admin' | 'board' | 'treasurer' | 'member' | 'associate'
 }) {
   const v = parseInput(createInviteSchema, input)
   if (!v.ok) return { error: v.error }
@@ -31,6 +33,10 @@ export async function createInvite(input: {
   if (!auth.ok) return { error: auth.error }
   const { member } = auth
 
+  if (!canAssignInviteRole(member.role, v.data.role)) {
+    return { error: `You cannot create an invite that grants the "${v.data.role}" role.` }
+  }
+
   // Generate a unique code if not provided. Try up to 5 times in case of collision.
   let code = v.data.code
   if (!code) {
@@ -52,6 +58,7 @@ export async function createInvite(input: {
       expires_at: v.data.expires_at ?? null,
       max_uses: v.data.max_uses ?? null,
       is_enabled: v.data.is_enabled ?? true,
+      role: v.data.role,
       created_by: member.id,
     })
     .select('id, code')
@@ -67,6 +74,7 @@ export async function updateInvite(inviteId: string, updates: {
   expires_at?: string | null
   max_uses?: number | null
   is_enabled?: boolean
+  role?: 'admin' | 'board' | 'treasurer' | 'member' | 'associate'
 }) {
   const idCheck = parseInput(uuidSchema, inviteId)
   if (!idCheck.ok) return { error: 'Invalid invite ID' }
@@ -78,11 +86,16 @@ export async function updateInvite(inviteId: string, updates: {
   if (!auth.ok) return { error: auth.error }
   const { member } = auth
 
+  if (v.data.role !== undefined && !canAssignInviteRole(member.role, v.data.role)) {
+    return { error: `You cannot set an invite to grant the "${v.data.role}" role.` }
+  }
+
   const patch: Record<string, unknown> = {}
   if (v.data.label      !== undefined) patch.label = v.data.label
   if (v.data.expires_at !== undefined) patch.expires_at = v.data.expires_at
   if (v.data.max_uses   !== undefined) patch.max_uses = v.data.max_uses
   if (v.data.is_enabled !== undefined) patch.is_enabled = v.data.is_enabled
+  if (v.data.role       !== undefined) patch.role = v.data.role
 
   const { error } = await supabase
     .from('space_invites')