AXI: Restrictions on slave address spaces?
Does the AXI specification impose any restrictions on the address
space of slaves?

As per the standards, 4KB is the minm. addressing space for any slave on AXI bus interconnect. This is to simplify the address decoding in the interconnect. Of course it can have a larger addressing space, but again it has to be in the multiples of 4KB. The base addresses for slaves in the interconnect are also hence assigned in multiples of 4K.
Prohibition of a burst crossing 4KB boundaries is there in the standards to avoid the possibility of accessing a different slave during the burst.

a slave is free to be assigned a 1-byte range or even a 2-byte range that crosses a 4KB boundary such as 0x0fff:0x1000, inclusive. Is this forbidden anywhere in the spec?

A slave can't have that addressing range on the bus. Its base address has to be 4K aligned. Say, 0x0. Still 0xFFF, 0x1000 can be decoded as offset addresses by the slave, which correspond to the first and second registers of the slave. But that's an inefficient way of implementing a slave. Since the second memory-mapped register at 0x1000 crosses the 4KB boundary, the interconnect will now have to allocate an addressing space of 0x0 to 0x1FFF to the slave. That's a wastage of extra 4KB in the addressing space.
Also, you won't be able to perform a burst of two transfers on the registers at 0xFFF and 0x1000, as it crosses the 4K boundary, and hence violates the AXI standards.