feat(invites): role-granting + usage-capped invites; audit hardening (P7)

Invites
- migration 029: space_invites.role (member_role enum, default
  'member' — legacy invites and the spaces.invite_code path keep
  granting member). schema.sql + types/database.ts mirrored
- lib/invite-logic.ts (pure, tested): canAssignInviteRole — admin may
  grant any role; board may grant anything except admin; nobody else.
  Privilege-escalation guard on top of the existing admin/board gate
- createInvite/updateInvite take + enforce role via that guard;
  createInviteSchema/updateInviteSchema validate the enum
- joinSpace applies the invite's granted role (validated), default
  member; uses_count/max_uses/expiry already enforced
- invites panel: role picker (filtered to what the creator may grant),
  one-click "single use", per-invite role badge
- space-scoped invite link /join/<space>?code=… via a presentational
  app/join/[space] landing that hands off to the proven
  /signup?invite= flow; /join added to middleware PUBLIC_ROUTES

Audit hardening (from this pass's review)
- /login now honors a validated same-origin ?next= (was hardcoded to
  /dashboard) so the public_auth form sign-in round-trips; OAuth
  threads next through the callback (which already honored it)
- submitForm requires formId; submitFormSchema drops the now-ambiguous
  slug path (form slugs are per-space after 028). Both callers already
  pass formId. Tests updated

337 tests; build verified (Compiled successfully, exit 0). No deploy.

scripts/029_invite_roles.sql

@@ -0,0 +1,19 @@
+-- =============================================================================
+-- 029: Invite codes can grant a role
+-- =============================================================================
+-- An invite can now mint a member at a chosen role (e.g. a single-use link
+-- that makes the joiner an admin). The role reuses the existing member_role
+-- enum, so the value set is constrained by the type. Default 'member'
+-- preserves the behaviour of every existing invite and the legacy
+-- spaces.invite_code path.
+--
+-- Security note: who may CREATE a role-granting invite is enforced in the
+-- application (lib/actions/invites.ts + lib/invite-logic.ts): invite creation
+-- is admin/board-gated, and only an admin may create an invite that grants
+-- 'admin'. This column just records the granted role; joinSpace applies it.
+--
+-- Idempotent: ADD COLUMN IF NOT EXISTS.
+-- =============================================================================
+
+ALTER TABLE public.space_invites
+  ADD COLUMN IF NOT EXISTS role public.member_role NOT NULL DEFAULT 'member';