feat(ff): implement admin form editor

[frozencodx]

What does this PR do?

Implements an admin-only form editor for the form frontend.

Admins can:

• list existing forms
• create new forms
• edit form metadata and fields
• toggle form active state
• delete forms

The editor includes a visual field builder and a preview mode that reuses the existing FieldRenderer component to match the FormSubmissionPage UI.

All create/update operations produce payloads compliant with the backend FormCreate schema.

---

Key Features

• Admin form list page (/admin/forms)
• Form creation page (/admin/forms/new)
• Form editing page (/admin/forms/:formId/edit)
• Field builder with:
  • add / remove fields
  • reorder fields
  • configure field properties
• Preview mode using the existing FieldRenderer

---

Related Issue

Closes #103

Checklist

• Code follows project conventions
• I tested my changes locally
• Linting passes
• I updated/added tests for my changes
• I added @seberatolmez or @DogukanUrker as reviewers

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
gdg-yu-form-service	Ready	Preview, Comment	Mar 12, 2026 6:21pm
gdg-yu-forms	Ready	Preview, Comment	Mar 12, 2026 6:21pm
gdg-yu-user-service	Ready	Preview, Comment	Mar 12, 2026 6:21pm

[seberatolmez]

ci checks are failing

[seberatolmez]

Great progress @frozencodx — most of the previous review items are properly addressed. Two blockers remain before this pr can merge.

❌ Blockers

1. Real API token committed to the repository

services/form/app/config.py:

ADMIN_API_TOKEN: str = "9374c8c7ab72df4d04b904a0e02acb00ec74b84474514fe301d9ccc259bc8eb0"

services/form/.env.example:

ADMIN_API_TOKEN=9374c8c7ab72df4d04b904a0e02acb00ec74b84474514fe301d9ccc259bc8eb0

The token is now publicly visible in the repo history. Two fixes needed:

• config.py: Remove the default entirely so a missing .env causes a startup error rather than silently using a known-compromised token:

  ADMIN_API_TOKEN: str  # no default — must be set via .env

• .env.example: Replace the real value with a placeholder:

  ADMIN_API_TOKEN=your-secure-random-token-here
  

Also rotate the token itself — since it's already public, the current value should be considered compromised.

2. CI is failing — Biome schema/version mismatch

biome.json and frontend/biome.json both declare:

"$schema": "https://biomejs.dev/schemas/2.4.6/schema.json"

But package.json installs:

"@biomejs/biome": "^2.3.11"

The installed version doesn't satisfy the 2.4.x schema, which is why linting CI is red. Fix: bump the devDependency to ^2.4.6 and regenerate the lockfile with bun install, or downgrade both schema references back to 2.3.x.

---

(quick fix, worth doing before merge)

deleteForm in formService.ts duplicates the auth header logic manually instead of going through authenticatedRequest like createForm and updateForm do. Any future auth header change would need to be made in two places. Simple fix:

export async function deleteForm(formId: string): Promise<void> {
  await authenticatedRequest<void>(`/forms/${encodeURIComponent(formId)}`, {
    method: "DELETE",
  });
}

[seberatolmez]

Everything from both previous review rounds has been properly addressed. But a few things before merge this pr.
I mentioned that /views/:formId isn't under /admin/. You've moved the logic correctly but the page still isn't under /admin folder.

[seberatolmez]

Why you didn't use tailwind rather than an extra css file

[seberatolmez]

One optional note for a follow-up: AdminPasswordGate currently lets any non-empty string unlock the UI (real auth happens on the first API call). If you want immediate feedback for a wrong token, consider a lightweight preflight request on the "Panele Gir" action. However, this is not a blocker for this PR.

[seberatolmez]

you've done a great job @frozencodx . Looks fine to me, you can merge after @DogukanUrker 's approval.