feat(invites): role-granting + usage-capped invites; audit hardening (P7)

Invites
- migration 029: space_invites.role (member_role enum, default
  'member' — legacy invites and the spaces.invite_code path keep
  granting member). schema.sql + types/database.ts mirrored
- lib/invite-logic.ts (pure, tested): canAssignInviteRole — admin may
  grant any role; board may grant anything except admin; nobody else.
  Privilege-escalation guard on top of the existing admin/board gate
- createInvite/updateInvite take + enforce role via that guard;
  createInviteSchema/updateInviteSchema validate the enum
- joinSpace applies the invite's granted role (validated), default
  member; uses_count/max_uses/expiry already enforced
- invites panel: role picker (filtered to what the creator may grant),
  one-click "single use", per-invite role badge
- space-scoped invite link /join/<space>?code=… via a presentational
  app/join/[space] landing that hands off to the proven
  /signup?invite= flow; /join added to middleware PUBLIC_ROUTES

Audit hardening (from this pass's review)
- /login now honors a validated same-origin ?next= (was hardcoded to
  /dashboard) so the public_auth form sign-in round-trips; OAuth
  threads next through the callback (which already honored it)
- submitForm requires formId; submitFormSchema drops the now-ambiguous
  slug path (form slugs are per-space after 028). Both callers already
  pass formId. Tests updated

337 tests; build verified (Compiled successfully, exit 0). No deploy.

lib/invite-logic.ts

@@ -0,0 +1,25 @@
+// Pure invite-role policy. No deps so it is unit-testable and shared by the
+// server action, the validations, and the panel UI.
+
+export const INVITE_ROLES = ['admin', 'board', 'treasurer', 'member', 'associate'] as const
+export type InviteRole = (typeof INVITE_ROLES)[number]
+
+export function isInviteRole(v: string): v is InviteRole {
+  return (INVITE_ROLES as readonly string[]).includes(v)
+}
+
+/**
+ * Whether a member with `creatorRole` may create an invite that grants
+ * `target`. Invite creation is already admin/board-gated upstream; this is
+ * the privilege-escalation guard on top of that:
+ *   - admin may grant any role
+ *   - board may grant anything EXCEPT admin (a board member cannot mint
+ *     admin access)
+ *   - anyone else: no (they never reach invite creation anyway)
+ */
+export function canAssignInviteRole(creatorRole: string, target: string): boolean {
+  if (!isInviteRole(target)) return false
+  if (creatorRole === 'admin') return true
+  if (creatorRole === 'board') return target !== 'admin'
+  return false
+}