Forms: a file upload, an opening and closing date, and several steps on a public submission

Found by simulating a Claude Code build of Color Me Fun 2026 through the barako CLI (epic #801) on 14 September 2026; the event registration app for the Rotary Club of Koronadal is the acceptance test. Simulation page: https://claude.ai/code/artifact/05afda1a-6461-431d-aff0-50b30d3b0778

A public visitor cannot create an entry today: the anonymous write endpoints are sign-in, OTP, registration and the client error and PWA reports, and `POST /api/files` requires a capability. The Forms module (#720) is the answer for a contact form. An event registration needs three things beyond it.

## Change

- **A file attached to a submission.** A visitor uploads a receipt (JPG, PNG or PDF, up to a configured size) as part of the submission, scanned the way uploads are today, stored as a private file owned by the entry, never publicly delivered.
- **Opening and closing dates from settings.** A form refuses submissions outside a window read from a singleton field (`RegistrationClosesAt`), with a clear message, so closing registration is editing a date.
- **Several steps.** One entry assembled across steps, validated per step on the server, submitted once. A half-finished submission is not an entry.

## Done when

- An anonymous visitor submits a registration with a receipt, and the receipt is readable only by roles that can read the entry.
- A submission after the closing date is refused, and moving the date reopens it with no deploy.

## Where it lives

Module: `BarakoCMS.Forms` for opening and closing dates and steps. A file upload field uses the core's `file` field type (#668) with storage from the Files module through the core interface.

Start in the BarakoCMS.Forms module, then read the core file field type (#668), the Files module interface, and the existing anonymous write endpoints. Trace how uploads are scanned and how entries are authorized before deciding how the form window and multi-step submission fit together. Done means the stated receipt privacy, closing-date refusal and reopening behavior work in the Color Me Fun registration acceptance test.

Written by the indexing model from the issue text.