feat(09-06): serve admin form schemas and match Winter relations

- GET schema/form localizes the compiled form after the permission check
- relation: genre resolves to the exported Go field without changing the YAML key

cabana/http.go

@@ -125,6 +125,8 @@ func (s *service) mount(r pact.Router) {
 		g.Get("/auth/me", s.me)
 		g.Get("/{vendor}/{plugin}/{controller}/schema/list", s.listSchema)
 		constrainController(g)
+		g.Get("/{vendor}/{plugin}/{controller}/schema/form", s.formSchema)
+		constrainController(g)
 		g.Get("/{vendor}/{plugin}/{controller}", s.list)
 		constrainController(g)
 		g.Post("/{vendor}/{plugin}/{controller}", s.create)
@@ -146,6 +148,25 @@ func constrainController(g pact.Router) {
 	g.Where("controller", "[A-Za-z0-9_-]+")
 }
 
+func (s *service) formSchema(w http.ResponseWriter, r *http.Request) {
+	s.protect(w, r, func(cc *CompiledController) {
+		if cc.Form == nil {
+			WriteError(w, http.StatusNotFound, "not_found", msgNotFound)
+			return
+		}
+		view, err := cc.Form.Localize(r.Context(), s.translator(), dropdownProvider(cc.Controller))
+		if err != nil {
+			WriteError(w, http.StatusInternalServerError, "error", msgServerError)
+			return
+		}
+		meta := map[string]any{}
+		if view.Meta.Locale != "" {
+			meta["locale"] = view.Meta.Locale
+		}
+		WriteData(w, http.StatusOK, view, meta)
+	})
+}
+
 func (s *service) listSchema(w http.ResponseWriter, r *http.Request) {
 	s.protect(w, r, func(cc *CompiledController) {
 		schema := cc.List