fix: JSONB fields_for + validate submit wiring; feat: checkbox_group (#10 #11 #9) - #14

Summary

Closes three open issues in one branch (three commits) — bundled because all
three touch lib/forms/form.rb, so separate branches would just conflict there.

#10 — fields_for iterated a Hash (JSONB) association

A Hash responds to #each_with_index, so a JSONB column rendered with
nested_attributes: false was iterated as [key, value] pairs, emitting
scope[assoc][0][field], [1], … instead of a single scope[assoc][field].
Now only genuine collections iterate — Enumerable && !Hash covers Array and
ActiveRecord::Relation without a hard ActiveRecord dependency.

#11 — Form(validate: true) never blocked submit

The coordinator controller and novalidate were attached, but no data-action
wired its onSubmit handler — the controller connected yet onSubmit never
fired. apply_validation_coordinator now emits
submit->forms--validations--form#onSubmit, joined with any caller-supplied
data-action.

#9 — checkbox_group verb (the tag/facet-picker shape)

f.checkbox_group(:tag_ids, Tag.all, value: :id, label: :name, variant: :pill, size: :sm)
f.field :tag_ids, as: :checkbox_group, collection: Tag.all, value: :id, label: :name

One array-valued field name (user[tag_ids][]) + a leading empty-array hidden
field, checked state derived from the model's current value, rendered under both
themes. The daisy leaf delegates each box to DaisyUI::Checkbox (literal size
class); the Plain twin ships zero styling. variant: is layout-only, no JS.

Test Coverage

• Bug: fields_for iterates a Hash-backed association (JSONB), emitting bogus indices #10: Hash-backed scope → single record[profile][phone], no [0]/[1].
• Bug: Form(validate: true) coordinator never wires its submit handler #11: data-action emitted; a caller data-action is preserved alongside it.
• Feature: a checkbox-group builder verb for array-valued associations #9: shared array name + empty hidden field; checked set from the model;
  option id derivation; label: proc with fallback; HTML-escaping; size:
  class; as: :checkbox_group inference; plain-theme parity; role mapped in both themes.

Full suite: 141 examples, 0 failures · rubocop lib spec clean.

Deviations & judgment calls

• Bug: Form(validate: true) coordinator never wires its submit handler #11 fix location: the issue recommended option 2 (self-wire in the JS
  controller's connect()). I chose option 1 (emit the data-action from
  Ruby) — it's the only surface the existing test suite can prove (no JS test
  harness), and it's idiomatic Stimulus. Doing both would double-bind
  onSubmit (fire twice), so form_controller.js is left unchanged; its
  existing onSubmit class-field handler is reachable via the emitted action.
• Bug: fields_for iterates a Hash-backed association (JSONB), emitting bogus indices #10 predicate: the issue suggested Array || ActiveRecord::Relation. I
  used Enumerable && !Hash — covers AR::Relation (includes Enumerable)
  without a hard ActiveRecord dependency (the gem must boot without AR), and
  still excludes the Hash-backed JSONB scope. A single record / Struct / PORO is
  not Enumerable → single scope, unchanged.
• Feature: a checkbox-group builder verb for array-valued associations #9 checked-set matching: the model's current value (record.tag_ids) is
  already the raw values, so the checked set compares against them directly —
  value: is not re-applied to them. This matches existing collection_check_boxes
  behavior (no type coercion; a string/integer id mismatch is a known, gem-wide
  v1 limitation).
• Feature: a checkbox-group builder verb for array-valued associations #9 size class: hand-emitting "checkbox-#{size}" would break the
  no-interpolated-class rule, so the daisy leaf delegates the checkbox markup to
  DaisyUI::Checkbox with a modifier symbol → literal registered class. The
  Plain twin overrides render_checkbox to a bare <input>.
• Feature: a checkbox-group builder verb for array-valued associations #9 required:: a group sharing one array name can't satisfy the browser's
  required on any single box, so render_field_input drops it for
  :checkbox_group (validate server-side) — same posture as :tags.