feat(builder): FORMS package -- field editor, functional Subscribe/Search, box-model+anim rollout

- FormStylePanel: ContactForm field editor (add/remove/reorder via
  ArrayPropEditor + manual move up/down) covering label/name/placeholder/
  type (full sanitizeInputType allowlist + textarea/select)/required/
  options.
- SubscribeForm.toHtml: was a dead `<form method="POST">` with no action at
  all -- wired through the same relayFormWiring contract as ContactForm/
  FormContainer so a recipientEmail makes it actually submit (marker +
  placeholder action + honeypot), falling back to action="#" otherwise.
- SearchBar: was purely decorative (no action/method/input name) -- now a
  real GET form (configurable target, default "/") with input name="q",
  safeUrl-guarded against javascript:/vbscript: breakout.
- Box-model (margin/padding per-side, border, shadow, opacity), entrance
  animation, and hide-on-device controls added to FormStylePanel and
  rolled out (blank/false craft.props defaults) across ContactForm,
  FormContainer, InputField, TextareaField, FormButton, SubscribeForm,
  SearchBar. No toHtml changes needed for animation/visibility --
  html-export.ts's buildDataAttrs() already emits data-animation/
  data-hide-* generically from these prop names.
- Extended toHtml tests for all 7 components: field-type rendering
  (incl. textarea/select), type-attribute XSS sanitization, relay/GET
  functional wiring, box-model style passthrough, craft.props defaults.

npx vitest run: 689/689 passed. npm run build: green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

craft/src/components/forms/SubscribeForm.toHtml.test.ts

@@ -6,7 +6,7 @@ const toHtml = (SubscribeForm as any).toHtml;
 describe('SubscribeForm.toHtml hardcoded attributes stay hardcoded (no raw prop breakout)', () => {
   test('form method is always POST regardless of any injected props', () => {
     const { html } = toHtml({ heading: 'Join us', method: 'GET"><script>alert(1)</script>' } as any, '');
-    expect(html).toContain('<form method="POST"');
+    expect(html).toMatch(/<form action="[^"]*" method="POST"/);
     expect(html).not.toContain('<script');
   });
 
@@ -37,3 +37,45 @@ describe('SubscribeForm.toHtml hardcoded attributes stay hardcoded (no raw prop
     expect(html).toContain('>Go<');
   });
 });
+
+// F1: SubscribeForm previously emitted `<form method="POST">` with no action
+// at all -- a published subscribe form silently did nothing on submit.
+// Wired through the same relay contract as ContactForm/FormContainer
+// (utils/form-relay-wiring.ts) so setting a recipient makes it functional.
+describe('SubscribeForm.toHtml is functional (not a dead POST)', () => {
+  test('without a recipient: still has a real (non-empty) action -- "#" fallback, not a bare method="POST"', () => {
+    const { html } = toHtml({}, '');
+    expect(html).toMatch(/<form action="#" method="POST"/);
+  });
+
+  test('with recipientEmail: emits the relay marker, placeholder action, and honeypot -- a working submission path', () => {
+    const { html } = toHtml({ recipientEmail: 'news@example.com', thankYouUrl: '/thanks' }, '', 'node-sub1');
+    expect(html).toMatch(/<!--WHP-FORM id="F_[0-9a-z]+" recipient="news@example.com" thankyou="\/thanks"-->/);
+    expect(html).toMatch(/action="__WHP_FORM_ACTION__F_[0-9a-z]+__"/);
+    expect(html).toContain('name="_gotcha"');
+    const mid = html.match(/id="(F_[0-9a-z]+)"/)![1];
+    expect(html).toContain(`__WHP_FORM_ACTION__${mid}__`);
+  });
+
+  test('the email input keeps its name="email" so the relay receives it', () => {
+    const { html } = toHtml({ recipientEmail: 'news@example.com' }, '', 'node-sub2');
+    expect(html).toContain('name="email"');
+  });
+});
+
+describe('SubscribeForm.toHtml box-model style passthrough', () => {
+  test('margin/border/box-shadow/opacity flow through via the style prop', () => {
+    const { html } = toHtml({ style: { marginTop: '16px', border: '1px solid #ddd', boxShadow: '0 2px 6px rgba(0,0,0,.15)', opacity: '0.85' } }, '');
+    expect(html).toContain('margin-top:16px');
+    expect(html).toContain('border:1px solid #ddd');
+    expect(html).toContain('opacity:0.85');
+  });
+});
+
+describe('SubscribeForm.craft.props includes animation/visibility defaults', () => {
+  test('has blank/false defaults', () => {
+    expect(SubscribeForm.craft!.props).toMatchObject({
+      animation: '', animationDelay: '', hideOnDesktop: false, hideOnTablet: false, hideOnMobile: false,
+    });
+  });
+});