feat(invites): role-granting + usage-capped invites; audit hardening (P7)

Invites
- migration 029: space_invites.role (member_role enum, default
  'member' — legacy invites and the spaces.invite_code path keep
  granting member). schema.sql + types/database.ts mirrored
- lib/invite-logic.ts (pure, tested): canAssignInviteRole — admin may
  grant any role; board may grant anything except admin; nobody else.
  Privilege-escalation guard on top of the existing admin/board gate
- createInvite/updateInvite take + enforce role via that guard;
  createInviteSchema/updateInviteSchema validate the enum
- joinSpace applies the invite's granted role (validated), default
  member; uses_count/max_uses/expiry already enforced
- invites panel: role picker (filtered to what the creator may grant),
  one-click "single use", per-invite role badge
- space-scoped invite link /join/<space>?code=… via a presentational
  app/join/[space] landing that hands off to the proven
  /signup?invite= flow; /join added to middleware PUBLIC_ROUTES

Audit hardening (from this pass's review)
- /login now honors a validated same-origin ?next= (was hardcoded to
  /dashboard) so the public_auth form sign-in round-trips; OAuth
  threads next through the callback (which already honored it)
- submitForm requires formId; submitFormSchema drops the now-ambiguous
  slug path (form slugs are per-space after 028). Both callers already
  pass formId. Tests updated

337 tests; build verified (Compiled successfully, exit 0). No deploy.

scripts/029_invite_roles.sql

@@ -0,0 +1,19 @@
+-- =============================================================================
+-- 029: Invite codes can grant a role
+-- =============================================================================
+-- An invite can now mint a member at a chosen role (e.g. a single-use link
+-- that makes the joiner an admin). The role reuses the existing member_role
+-- enum, so the value set is constrained by the type. Default 'member'
+-- preserves the behaviour of every existing invite and the legacy
+-- spaces.invite_code path.
+--
+-- Security note: who may CREATE a role-granting invite is enforced in the
+-- application (lib/actions/invites.ts + lib/invite-logic.ts): invite creation
+-- is admin/board-gated, and only an admin may create an invite that grants
+-- 'admin'. This column just records the granted role; joinSpace applies it.
+--
+-- Idempotent: ADD COLUMN IF NOT EXISTS.
+-- =============================================================================
+
+ALTER TABLE public.space_invites
+  ADD COLUMN IF NOT EXISTS role public.member_role NOT NULL DEFAULT 'member';

scripts/schema.sql

@@ -1574,6 +1574,7 @@ CREATE TABLE IF NOT EXISTS public.space_invites (
   max_uses    integer CHECK (max_uses IS NULL OR max_uses > 0),
   uses_count  integer     NOT NULL DEFAULT 0 CHECK (uses_count >= 0),
   is_enabled  boolean     NOT NULL DEFAULT true,
+  role        member_role NOT NULL DEFAULT 'member',
   created_by  uuid        REFERENCES public.space_members(id) ON DELETE SET NULL,
   created_at  timestamptz NOT NULL DEFAULT now(),
   updated_at  timestamptz NOT NULL DEFAULT now()