test(forms): run the starter's form client against the public forms routes

[ABB65]

E6 gap 1: nothing ran the browser client every Migrate-delivered site ships against Studio's public forms routes. Each side was tested alone, so a drift in field names, the honeypot, the Turnstile token or the response shape would only show up on a live site.

What this adds

tests/integration/starter-form-contract.integration.test.ts runs the starter's embed.ts (copied to tests/fixtures/starter/, byte-identical, excluded from eslint so it stays so) against the real config.get and submit.post handlers. Only the database, Git and Turnstile's siteverify are mocked.

It walks the visitor's chain: config → the controls the client renders (names, honeypot, Turnstile widget) → the form data → the request body → Studio's answer.

• success: body { data, captchaToken, _hp }; only exposed fields are stored (internal_note never appears); success message returned
• filled honeypot: silent success, nothing written
• missing or rejected Turnstile token: success: false with captcha error; siteverify is not called without a token
• required field empty: success: false with { field, message } entries
• locked workspace: 402 on config and submit, which the client reads as payment_required (widget hidden)

Refreshing the fixture

Copy the starter's embed.ts again when it changes (README in the fixture folder). A change that breaks the contract fails pnpm test:ci.

Tests

pnpm exec vitest run --project integration tests/integration/starter-form-contract.integration.test.ts: 5 passed.

[ABB65]

ONAY (t6) — 1815918

• PR yalnız 4 dosya: eslint ignore (tests/fixtures/starter/**), starter README, embed.ts, form sözleşme testi. Çekirdek/ee sınırı: ee importu yok, sunucu kodu değişmiyor.
• embed.ts, Migrate'in packages/writer/starter/src/lib/studio/embed.ts dosyasıyla bayt-bayt aynı (cmp).
• Testler: starter-form-contract 5/5; tam integration 51 dosya 472 test; eslint 0 hata (7 uyarı, hepsi eski); CI yeşil.
• Not: dal main'in gerisinde (migrate golden test(handoff): validate a Migrate-built handoff; accept the contract version range (E2 contract, 2/2) #399 sonrası) — PR diff'i yalnız yukarıdaki 4 dosya, çakışma yok.