feat: let guests publish a CommunityRule and claim it on this browser later

Finalize no longer requires a magic link. Guest rows stay off the catalog until sign-in on the same browser attaches ownership, and the login modal kebab no longer acts as a second close.

Co-authored-by: Cursor <cursoragent@cursor.com>

prisma/schema.prisma

@@ -79,6 +79,9 @@ model PublishedRule {
   document  Json
   createdAt DateTime @default(now())
   updatedAt DateTime @updatedAt
+  /// Hashed one-time secret so the publishing browser can claim this row on sign-in.
+  /// Null for owned publishes and after a successful claim.
+  claimTokenHash String? @unique
 
   stakeholders RuleStakeholder[]