feat: extend module platform with UI slots, runtime components, CLI tooling and {{userId}} search support

Completes the generic module platform that enables modules to contribute
UI elements, runtime JS components, and search resources without any
core hardcoding.

New generic UI slot types:
- topbar.right_item: module-contributed topbar buttons
- layout.body_end_template: module-contributed dialog/overlay templates
- layout.head_style: module-contributed global CSS
- runtime.component: declarative JS component registration with phase ordering

New infrastructure:
- ModuleAutoloader: PSR-4 autoloading for module-local PHP classes
- ModuleRuntimePageBuilder: symlinks module pages into runtime directory
- ModuleRuntimeAssetPublisher: publishes module CSS/JS to web/modules/
- ModulePermissionSynchronizer: syncs module permissions to DB
- CLI scripts: module-runtime-sync, module-build, module-migrate,
  module-permissions-sync, module-assets-sync
- {{userId}} placeholder in SearchDataService for user-scoped search queries
- Component runtime with phased initialization (early/default/late)
- AppContainer.protectExistingBindings() to prevent module→core overwrites
- Architecture tests: ModuleStructureContractTest, CoreTemplateIsolationTest,
  FrontendComponentRuntimeContractTest, AppContainerIsolationContractTest

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

bin/module-runtime-sync.php

@@ -0,0 +1,67 @@
+#!/usr/bin/env php
+<?php
+
+declare(strict_types=1);
+
+require_once __DIR__ . '/module-cli-bootstrap.php';
+
+require_once __DIR__ . '/module-migrate.php';
+require_once __DIR__ . '/module-permissions-sync.php';
+require_once __DIR__ . '/module-build.php';
+require_once __DIR__ . '/module-assets-sync.php';
+
+function moduleRuntimeSyncRun(): int
+{
+    moduleCliBootstrapApp();
+    $warningsBeforeAll = moduleCliVendorWarningsIgnoredTotal();
+
+    $steps = [
+        'migrate' => static fn (): int => moduleMigrateRun(),
+        'permissions-sync' => static fn (): int => modulePermissionsSyncRun(),
+        'build' => static fn (): int => moduleBuildRun(),
+        'assets-sync' => static fn (): int => moduleAssetsSyncRun(),
+    ];
+
+    $statusByStep = [];
+    foreach (array_keys($steps) as $stepName) {
+        $statusByStep[$stepName] = 'pending';
+    }
+
+    $finalExitCode = 0;
+    foreach ($steps as $stepName => $runner) {
+        $stepWarningsBefore = moduleCliVendorWarningsIgnoredTotal();
+        $stepExitCode = $runner();
+        $stepWarnings = moduleCliVendorWarningsIgnoredSince($stepWarningsBefore);
+        $stepStatus = $stepExitCode === 0 ? 'ok' : 'failed';
+        $statusByStep[$stepName] = $stepStatus;
+
+        fwrite(STDOUT, sprintf(
+            "module-runtime-sync: step=%s status=%s exit_code=%d vendor_warnings_ignored=%d\n",
+            $stepName,
+            $stepStatus,
+            $stepExitCode,
+            $stepWarnings
+        ));
+
+        if ($stepExitCode !== 0) {
+            $finalExitCode = $stepExitCode;
+            break;
+        }
+    }
+
+    $totalVendorWarnings = moduleCliVendorWarningsIgnoredSince($warningsBeforeAll);
+    fwrite(STDOUT, sprintf(
+        "module-runtime-sync: summary migrate=%s permissions-sync=%s build=%s assets-sync=%s vendor_warnings_ignored=%d\n",
+        $statusByStep['migrate'],
+        $statusByStep['permissions-sync'],
+        $statusByStep['build'],
+        $statusByStep['assets-sync'],
+        $totalVendorWarnings
+    ));
+
+    return $finalExitCode;
+}
+
+if (PHP_SAPI === 'cli' && realpath((string) ($_SERVER['SCRIPT_FILENAME'] ?? '')) === __FILE__) {
+    exit(moduleRuntimeSyncRun());
+}