Apply routes → services → repositories layering to forms (#640, part 1)

[abhishek-8081]

Part 1 of #640 (forms; templates follow in part 2).

Applies the routes → services → repositories layering to the forms routes:

• New FormService (app/services/form.py) matching the InputService pattern — holds the
  fill orchestration (resolves transcript, calls the existing Controller unchanged,
  persists via repository), the submissions list, analytics, and purge logic.
• The 3 inline DB queries moved from forms.py into repository functions (get_submissions,
  get_submissions_with_template, get_submissions_before).
• forms.py routes are now thin: parse → FormService → return. HTTP concerns (404 template
  check, 500 Controller-exception wrapping, AppError bubbling) stay in the route.
• Controller is unchanged — the service calls it, doesn't absorb it.

Behavior unchanged — 152 tests pass with only mock-location changes (Controller/PROJECT_ROOT
now patched at their new service location), no response-assertion changes. ruff check app/
clean. No direct DB queries remain in forms.py.

Known follow-up: _resolve_project_file/PROJECT_ROOT is temporarily duplicated between
forms.py (untouched delete endpoint) and form.py (purge) — will consolidate when the delete
endpoint moves to the service.

Templates layering is part 2 (separate PR).