feat: let guests publish a CommunityRule and claim it on this browser later

Finalize no longer requires a magic link. Guest rows stay off the catalog until sign-in on the same browser attaches ownership, and the login modal kebab no longer acts as a second close.

Co-authored-by: Cursor <cursoragent@cursor.com>

prisma/migrations/20260826160000_add_published_rule_claim_token/migration.sql

@@ -0,0 +1,5 @@
+-- AlterTable
+ALTER TABLE "PublishedRule" ADD COLUMN "claimTokenHash" TEXT;
+
+-- CreateIndex
+CREATE UNIQUE INDEX "PublishedRule_claimTokenHash_key" ON "PublishedRule"("claimTokenHash");

prisma/schema.prisma

@@ -79,6 +79,9 @@ model PublishedRule {
   document  Json
   createdAt DateTime @default(now())
   updatedAt DateTime @updatedAt
+  /// Hashed one-time secret so the publishing browser can claim this row on sign-in.
+  /// Null for owned publishes and after a successful claim.
+  claimTokenHash String? @unique
 
   stakeholders RuleStakeholder[]