refactor: use Kobalte for form fields

[jamesarosen]

Summary

• Adopts Kobalte UI (@kobalte/core) for form field components across
  the entire app, including a workaround for <Select required> causing
  inconsistent state.
  See fix(select): fix prop not working properly on hidden select input kobaltedev/kobalte#538
• Establish named JSX props as slot pattern, including a workaround for
  JSX props inside a <Show>.
  See Hydration error for rendered Elements that aren't inserted in the DOM during server rendering solidjs/solid#1977
• Migrated ListingForm, InquiryForm, and login to the new
  form field components
• Mitigate open redirect in login form
• E2E selectors updated from input#email (Kobalte generates its own
  IDs) to page.getByLabel(/email/i)

Bug Fixes

Severity	Fix
CRITICAL	Missing name="address" on ListingForm — field was silently dropped from FormData
CRITICAL	Kobalte Select missing <HiddenSelect /> — fruit type never reached FormData
HIGH	validationState computed outside reactive graph — error styling never applied
HIGH	Slot props inside <Show> broken (solidjs/solid#1977) — fixed with reactive accessor pattern
HIGH	FieldErrors.toArray() called outside reactive context — errors never updated
HIGH	InquiryForm auto-submit re-fired on remount — clear inquiry_complete URL param via History API
HIGH	InquiryForm auto-submit didn't validate stored listingId matches current listing
HIGH	returnTo open-redirect — /\evil.com bypassed startsWith('//') check; now uses new URL() origin check
MEDIUM	sessionStorage.setItem unguarded QuotaExceededError
MEDIUM	Show when={errors} truthy for [] — empty error container rendered when no errors
MEDIUM	Sentry.captureException called with string instead of Error (no stack trace)
MEDIUM	itemComponent now required in SelectFieldProps — omitting it caused silent empty listbox

Test Plan

• Create a listing: fill all fields, submit — fruit type and address appear in confirmation
• Create a listing: submit without fruit type — validation error appears
• Create a listing: submit without address — validation error appears
• Login: invalid returnTo like //evil.com is rejected
• Contact owner: magic link flow, then auto-submit on return
• Unit tests: pnpm --filter @pickmyfruit/www test:run
• Typecheck: pnpm --filter @pickmyfruit/www typecheck
• E2E: pnpm --filter @pickmyfruit/www test:e2e

Review Notes

• Named JSX props confirmed as the correct SolidJS slot pattern (no children
  classification; SSR-safe)
• <HiddenSelect /> is required for native FormData participation — Kobalte
  doesn't auto-render it
• Kobalte auto-generates input IDs; all selectors updated to use label/name/role
• InquiryForm auto-submit test coverage deferred to test(InquiryForm): add coverage for auto-submit after magic-link auth #146

🤖 Generated with Claude Code