feat: extend module platform with UI slots, runtime components, CLI tooling and {{userId}} search support

Completes the generic module platform that enables modules to contribute
UI elements, runtime JS components, and search resources without any
core hardcoding.

New generic UI slot types:
- topbar.right_item: module-contributed topbar buttons
- layout.body_end_template: module-contributed dialog/overlay templates
- layout.head_style: module-contributed global CSS
- runtime.component: declarative JS component registration with phase ordering

New infrastructure:
- ModuleAutoloader: PSR-4 autoloading for module-local PHP classes
- ModuleRuntimePageBuilder: symlinks module pages into runtime directory
- ModuleRuntimeAssetPublisher: publishes module CSS/JS to web/modules/
- ModulePermissionSynchronizer: syncs module permissions to DB
- CLI scripts: module-runtime-sync, module-build, module-migrate,
  module-permissions-sync, module-assets-sync
- {{userId}} placeholder in SearchDataService for user-scoped search queries
- Component runtime with phased initialization (early/default/late)
- AppContainer.protectExistingBindings() to prevent module→core overwrites
- Architecture tests: ModuleStructureContractTest, CoreTemplateIsolationTest,
  FrontendComponentRuntimeContractTest, AppContainerIsolationContractTest

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

config/assets.php

@@ -12,6 +12,7 @@ return [
             'shared' => [
                 'css/components/app-badges.css',
                 'css/layout/app-shell.css',
+                'css/components/app-dialog.css',
                 'css/components/app-blockquote.css',
                 'css/components/app-forms.css',
                 'css/components/app-flash.css',
@@ -46,14 +47,10 @@ return [
                 'css/vendor-overrides/editorjs.css',
                 'css/components/app-page-copy.css',
                 'css/layout/app-aside-icon-bar.css',
-                'css/components/app-bookmark-form.css',
             ],
             'login' => [
                 'css/pages/app-login.css',
             ],
-            'address-book' => [
-                'css/pages/address-book-view.css',
-            ],
             'error' => [
                 'css/pages/app-error.css',
             ],

config/modules.php

@@ -4,10 +4,13 @@
  * Module activation configuration.
  *
  * Modules listed here are loaded at boot time. The APP_ENABLED_MODULES env
- * variable (comma-separated) overrides this list when set.
+ * variable controls overrides with deterministic semantics:
+ * - APP_ENABLED_MODULES not set: use this config list
+ * - APP_ENABLED_MODULES='': explicit no-modules mode
+ * - APP_ENABLED_MODULES='a,b': exact module list from env
  *
  * Each entry must match a directory name under modules/ containing a module.php manifest.
  */
 return [
-    'enabled_modules' => ['addressbook'],
+    'enabled_modules' => ['addressbook', 'bookmarks'],
 ];

config/router.php

@@ -9,26 +9,41 @@ if (!is_array($routeDefinitions) || !$routeDefinitions) {
     $routeDefinitions = is_file($routesFile) ? include $routesFile : [];
 }
 
+$coreRoutePaths = [];
 if (is_array($routeDefinitions)) {
     foreach ($routeDefinitions as $route) {
         $path = trim((string) ($route['path'] ?? ''));
         $target = trim((string) ($route['target'] ?? ''));
-        if ($path !== '' && $target !== '') {
-            Router::addRoute($path, $target);
+        if ($path === '' || $target === '') {
+            continue;
         }
+        $coreRoutePaths[$path] = $target;
+        Router::addRoute($path, $target);
     }
 }
 
 // ── Module routes ────────────────────────────────────────────────────
-// Module routes are merged after core routes. The ModuleRegistry is
-// available at this point because registerContainer.php runs before
-// config/router.php is included.
-if (function_exists('app') && app(ModuleRegistry::class) instanceof ModuleRegistry) {
+// Module routes are merged after core routes. web/index.php includes this file
+// only after container bootstrap, so ModuleRegistry is available here.
+if (app(ModuleRegistry::class) instanceof ModuleRegistry) {
     $moduleRegistry = app(ModuleRegistry::class);
+    $modulePaths = [];
     foreach ($moduleRegistry->getRoutes() as $route) {
         $path = trim((string) $route['path']);
         $target = trim((string) $route['target']);
+        $moduleId = trim((string) $route['module_id']);
         if ($path !== '' && $target !== '') {
+            if (isset($coreRoutePaths[$path])) {
+                throw new RuntimeException(
+                    "Module route path conflict: '{$path}' from module '{$moduleId}' collides with core route target '{$coreRoutePaths[$path]}'."
+                );
+            }
+            if (isset($modulePaths[$path])) {
+                throw new RuntimeException(
+                    "Module route path conflict: '{$path}' from module '{$moduleId}' collides with module '{$modulePaths[$path]}'."
+                );
+            }
+            $modulePaths[$path] = $moduleId;
             Router::addRoute($path, $target);
         }
     }