feat(invites): role-granting + usage-capped invites; audit hardening (P7)

Invites
- migration 029: space_invites.role (member_role enum, default
  'member' — legacy invites and the spaces.invite_code path keep
  granting member). schema.sql + types/database.ts mirrored
- lib/invite-logic.ts (pure, tested): canAssignInviteRole — admin may
  grant any role; board may grant anything except admin; nobody else.
  Privilege-escalation guard on top of the existing admin/board gate
- createInvite/updateInvite take + enforce role via that guard;
  createInviteSchema/updateInviteSchema validate the enum
- joinSpace applies the invite's granted role (validated), default
  member; uses_count/max_uses/expiry already enforced
- invites panel: role picker (filtered to what the creator may grant),
  one-click "single use", per-invite role badge
- space-scoped invite link /join/<space>?code=… via a presentational
  app/join/[space] landing that hands off to the proven
  /signup?invite= flow; /join added to middleware PUBLIC_ROUTES

Audit hardening (from this pass's review)
- /login now honors a validated same-origin ?next= (was hardcoded to
  /dashboard) so the public_auth form sign-in round-trips; OAuth
  threads next through the callback (which already honored it)
- submitForm requires formId; submitFormSchema drops the now-ambiguous
  slug path (form slugs are per-space after 028). Both callers already
  pass formId. Tests updated

337 tests; build verified (Compiled successfully, exit 0). No deploy.

lib/validations.ts

@@ -1,4 +1,5 @@
 import { z } from 'zod'
+import { INVITE_ROLES } from './invite-logic'
 
 /**
  * Accepts every date-ish string the app produces and normalizes to a
@@ -476,6 +477,7 @@ export const createInviteSchema = z.object({
   expires_at: flexibleDateTime(),
   max_uses: z.number().int().min(1).max(100000).optional().nullable(),
   is_enabled: z.boolean().optional(),
+  role: z.enum(INVITE_ROLES).optional().default('member'),
 })
 
 export const updateInviteSchema = z.object({
@@ -483,6 +485,7 @@ export const updateInviteSchema = z.object({
   expires_at: flexibleDateTime(),
   max_uses: z.number().int().min(1).max(100000).optional().nullable(),
   is_enabled: z.boolean().optional(),
+  role: z.enum(INVITE_ROLES).optional(),
 })
 
 export const createChannelSchema = z.object({
@@ -649,17 +652,14 @@ export const formIdSchema = z.object({ formId: z.string().uuid('Invalid form ID'
 
 // Envelope only. The answers object is validated dynamically against the
 // form's stored field schema inside submitForm (see lib/forms-schema.ts).
-export const submitFormSchema = z
-  .object({
-    formId: z.string().uuid('Invalid form ID').optional(),
-    slug: formSlug.optional(),
-    answers: z.record(z.unknown()).default({}),
-    email: emailField().optional().nullable(),
-    consent: z.boolean().optional(),
-  })
-  .refine(d => Boolean(d.formId) || Boolean(d.slug), {
-    message: 'formId or slug is required',
-  })
+// formId is required: form slugs are only unique per space now, so a bare
+// slug is ambiguous. Both callers (public page + onboarding) submit by id.
+export const submitFormSchema = z.object({
+  formId: z.string().uuid('Invalid form ID'),
+  answers: z.record(z.unknown()).default({}),
+  email: emailField().optional().nullable(),
+  consent: z.boolean().optional(),
+})
 
 export const linkSubmissionsSchema = z.object({
   memberId: z.string().uuid('Invalid member ID'),