feat: extend module platform with UI slots, runtime components, CLI tooling and {{userId}} search support

Completes the generic module platform that enables modules to contribute
UI elements, runtime JS components, and search resources without any
core hardcoding.

New generic UI slot types:
- topbar.right_item: module-contributed topbar buttons
- layout.body_end_template: module-contributed dialog/overlay templates
- layout.head_style: module-contributed global CSS
- runtime.component: declarative JS component registration with phase ordering

New infrastructure:
- ModuleAutoloader: PSR-4 autoloading for module-local PHP classes
- ModuleRuntimePageBuilder: symlinks module pages into runtime directory
- ModuleRuntimeAssetPublisher: publishes module CSS/JS to web/modules/
- ModulePermissionSynchronizer: syncs module permissions to DB
- CLI scripts: module-runtime-sync, module-build, module-migrate,
  module-permissions-sync, module-assets-sync
- {{userId}} placeholder in SearchDataService for user-scoped search queries
- Component runtime with phased initialization (early/default/late)
- AppContainer.protectExistingBindings() to prevent module→core overwrites
- Architecture tests: ModuleStructureContractTest, CoreTemplateIsolationTest,
  FrontendComponentRuntimeContractTest, AppContainerIsolationContractTest

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

config/router.php

@@ -9,26 +9,41 @@ if (!is_array($routeDefinitions) || !$routeDefinitions) {
     $routeDefinitions = is_file($routesFile) ? include $routesFile : [];
 }
 
+$coreRoutePaths = [];
 if (is_array($routeDefinitions)) {
     foreach ($routeDefinitions as $route) {
         $path = trim((string) ($route['path'] ?? ''));
         $target = trim((string) ($route['target'] ?? ''));
-        if ($path !== '' && $target !== '') {
-            Router::addRoute($path, $target);
+        if ($path === '' || $target === '') {
+            continue;
         }
+        $coreRoutePaths[$path] = $target;
+        Router::addRoute($path, $target);
     }
 }
 
 // ── Module routes ────────────────────────────────────────────────────
-// Module routes are merged after core routes. The ModuleRegistry is
-// available at this point because registerContainer.php runs before
-// config/router.php is included.
-if (function_exists('app') && app(ModuleRegistry::class) instanceof ModuleRegistry) {
+// Module routes are merged after core routes. web/index.php includes this file
+// only after container bootstrap, so ModuleRegistry is available here.
+if (app(ModuleRegistry::class) instanceof ModuleRegistry) {
     $moduleRegistry = app(ModuleRegistry::class);
+    $modulePaths = [];
     foreach ($moduleRegistry->getRoutes() as $route) {
         $path = trim((string) $route['path']);
         $target = trim((string) $route['target']);
+        $moduleId = trim((string) $route['module_id']);
         if ($path !== '' && $target !== '') {
+            if (isset($coreRoutePaths[$path])) {
+                throw new RuntimeException(
+                    "Module route path conflict: '{$path}' from module '{$moduleId}' collides with core route target '{$coreRoutePaths[$path]}'."
+                );
+            }
+            if (isset($modulePaths[$path])) {
+                throw new RuntimeException(
+                    "Module route path conflict: '{$path}' from module '{$moduleId}' collides with module '{$modulePaths[$path]}'."
+                );
+            }
+            $modulePaths[$path] = $moduleId;
             Router::addRoute($path, $target);
         }
     }