feat: keep slug in sync with title, with a readonly-but-editable slug field and reject-on-collision option

[openrijal]

Summary

A few small improvements to the existing slugFields mechanism:

1. Keep the slug in sync with the title even after creation.
   Right now the live slug update only runs in create mode (AutoForm.vue:71 gates it on props.mode === 'create'). If an editor renames a post later, the slug goes stale. The watcher should also run in update mode — but only while the slug field is locked (see docs: document moving admin registry to nitro plugin #2).

2. Make the slug field readonly by default, with a way to unlock it.
   When a field is listed in slugFields, AutoFormField.vue should render it readonly with a small lock icon next to it (same pattern as WordPress and Strapi). Clicking the lock makes the field editable and pauses the auto-sync from the source field, so the editor's custom slug is not overwritten. This needs server/utils/form.ts and the formspec route to pass the slugFields info to the client.

3. Add a reject-on-collision option.
   Today ensureUniqueSlugs quietly appends -1, -2, etc. when a slug already exists. Add a config flag (e.g. slugCollision: 'suffix' | 'reject', default 'suffix' to keep current behavior). With 'reject', the server returns a validation error on the slug field so the editor knows to change the title or unlock and edit the slug by hand.

Why

• Stale slugs after a title edit are confusing for editors who expect the URL to follow the title.
• A locked-but-unlockable slug is a familiar pattern from WordPress and Strapi — safe by default, flexible when needed.
• Silent -2 suffixes can ship duplicate-looking URLs without the editor noticing. Some teams would rather be told and decide.