T1: Form editor: the restricted safe edit subset

[PrjShrestha]

Importance: Must have · Size: L · Depends on: nothing

Why. The core of Phase 1. A non-developer edits an existing form through a rendered view and
never encounters XLSForm rows, XPath, JSON or variable names. Everything else in the MVP assumes
this surface exists.

Scope.

• Edit question labels, per language.
• Edit hints and validation messages, per language.
• Add, edit, remove and reorder the options in a choice list.
• Toggle a question between mandatory and optional.
• Reorder questions. ⚠ A question cannot move ahead of a question it references — block the
  move and explain why, rather than emitting a broken form.
• Add and remove questions from a typed palette, grouped so a non-technical user can scan it:
  text & basic, choice, number, date & time, media, location.
• Add sections/groups, including nesting and the "show all on one screen" option.
  ⚠ Section open and close markers must always be emitted as a matched pair.
• A CHT-only filter that narrows the palette to types CHT supports.
• The CHT-specific date picker for the Nepali (Bikram Sambat) calendar.
• Per-question image, referencing a file the deploy carries as a form attachment.
• Simple vs Full mode. Simple shows label, choices and required only. Full reveals the
  advanced fields.
• Plain-language wrappers for the logic columns, so nobody edits raw syntax: "Show this
  question when…", "Compute the value as…", "Accept the answer only if…".
• ⚠ Refuse to edit variable names, with an explanation. Renaming a field mid-collection
  breaks the meaning of every record already gathered under the old name.

Not in scope. Branching-flow authoring beyond per-question conditions (see T9). Editing a form
that cannot be represented in the editor's model — such a form opens read-mostly.

Acceptance.

1. A user completes a label, choice, mandatory-flag and image edit in Simple mode without
   encountering an XLSForm column name, XPath expression, JSON, or a variable name.
2. Reordering a question ahead of one it references is refused with a comprehensible message.
3. A form containing sections survives an open-and-save with no edits byte-identically.
4. Attempting to rename a variable is refused and the reason is stated.

---