forms

Audit every user-facing form for client + server validation, visible error and success states, spam protection, and real persistence through a /api/v1 route. Use whenever the user mentions forms, waitlist, signup, contact form, form validation, "does the form actually save", spam, or submit handlers.