fix(rest): resolve public forms from flattened view metadata (#1989)

`findPublicFormView` (the /forms/:slug + /forms/:slug/submit resolver) only
matched the *authoring* view shape — `view.form.sharing` and
`view.formViews.{key}.sharing`. But `getMetaItems({type:'view'})` returns the
*registered* shape: one flattened item per view, `{ name, object, viewKind,
config: { data, sections, sharing } }`. The form's `sharing` (allowAnonymous +
publicLink) lives under `config`, which the resolver never inspected — so every
standard public form silently failed with FORM_NOT_FOUND, making Web-to-Lead /
Web-to-Case non-functional despite being fully declared.

Add a third candidate source: a `viewKind === 'form'` item whose `config` carries
`sharing`. Object name resolves via `config.data.object` / the item's `object`.

Verified end-to-end (HotCRM): anonymous GET /api/v1/forms/contact-us → 200 form
spec; POST /api/v1/forms/contact-us/submit (no auth) → creates a crm_lead;
/forms/support → crm_case; guest reads still 401 (INSERT-only enforced).

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: os-zhuang

packages/rest/src/rest-server.ts

@@ -3448,6 +3448,7 @@ export class RestServer {
             for (const view of views ?? []) {
                 if (!view || typeof view !== 'object') continue;
                 const candidates: Array<{ form: any; key?: string }> = [];
+                // Authoring/nested shape (defineView): { form, formViews: { key: {...} } }.
                 if (view.form && view.form.sharing) candidates.push({ form: view.form });
                 const formViews = view.formViews;
                 if (formViews && typeof formViews === 'object') {
@@ -3457,6 +3458,14 @@ export class RestServer {
                         }
                     }
                 }
+                // Flattened registered shape (getMetaItems → one item per view:
+                // { name, object, viewKind:'form', config:{ data, sections, sharing } }).
+                // A form view carries its sharing under `config`; without this branch
+                // public-form resolution silently fails for the standard view metadata.
+                if (view.viewKind === 'form' && view.config && typeof view.config === 'object'
+                    && (view.config as any).sharing) {
+                    candidates.push({ form: view.config, key: view.name });
+                }
                 for (const c of candidates) {
                     const sharing = c.form?.sharing;
                     if (!sharing || sharing.allowAnonymous !== true) continue;