feat: extend module platform with UI slots, runtime components, CLI tooling and {{userId}} search support

Completes the generic module platform that enables modules to contribute
UI elements, runtime JS components, and search resources without any
core hardcoding.

New generic UI slot types:
- topbar.right_item: module-contributed topbar buttons
- layout.body_end_template: module-contributed dialog/overlay templates
- layout.head_style: module-contributed global CSS
- runtime.component: declarative JS component registration with phase ordering

New infrastructure:
- ModuleAutoloader: PSR-4 autoloading for module-local PHP classes
- ModuleRuntimePageBuilder: symlinks module pages into runtime directory
- ModuleRuntimeAssetPublisher: publishes module CSS/JS to web/modules/
- ModulePermissionSynchronizer: syncs module permissions to DB
- CLI scripts: module-runtime-sync, module-build, module-migrate,
  module-permissions-sync, module-assets-sync
- {{userId}} placeholder in SearchDataService for user-scoped search queries
- Component runtime with phased initialization (early/default/late)
- AppContainer.protectExistingBindings() to prevent module→core overwrites
- Architecture tests: ModuleStructureContractTest, CoreTemplateIsolationTest,
  FrontendComponentRuntimeContractTest, AppContainerIsolationContractTest

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

lib/Service/Auth/AuthService.php

@@ -82,7 +82,7 @@ class AuthService
 
         $sessionUser = $this->sessionUser();
         if (!($sessionUser['active'] ?? 1)) {
-            Auth::logout();
+            $this->logoutWithModuleCleanup();
             $this->recordAuthEvent('auth.login.failed', 'failed', [
                 'error_code' => 'account_inactive',
                 'metadata' => ['email_hash' => \MintyPHP\Http\RequestContext::hashValue(strtolower($email))],
@@ -96,7 +96,7 @@ class AuthService
 
         $userId = (int) ($sessionUser['id'] ?? 0);
         if ($userId > 0 && !$this->isLocalPasswordLoginAllowedForUser($userId)) {
-            Auth::logout();
+            $this->logoutWithModuleCleanup();
             $this->recordAuthEvent('auth.login.failed', 'failed', [
                 'error_code' => 'password_login_disabled',
                 'metadata' => ['email_hash' => \MintyPHP\Http\RequestContext::hashValue(strtolower($email))],
@@ -111,7 +111,7 @@ class AuthService
             $this->permissionService->getUserPermissions($userId, true);
             $this->loadTenantDataIntoSession($userId);
             if ($this->noActiveTenant()) {
-                Auth::logout();
+                $this->logoutWithModuleCleanup();
                 $this->recordAuthEvent('auth.login.failed', 'failed', [
                     'error_code' => 'no_active_tenant',
                     'metadata' => ['email_hash' => \MintyPHP\Http\RequestContext::hashValue(strtolower($email))],
@@ -203,7 +203,7 @@ class AuthService
         $this->permissionService->getUserPermissions($userId, true);
         $this->loadTenantDataIntoSession($userId);
         if ($this->noActiveTenant()) {
-            Auth::logout();
+            $this->logoutWithModuleCleanup();
             $this->recordAuthEvent('auth.login.failed', 'failed', [
                 'error_code' => 'login_no_active_tenant',
                 'actor_user_id' => $userId,
@@ -277,7 +277,7 @@ class AuthService
         $actorUserId = (int) ($this->sessionUser()['id'] ?? 0);
         $actorTenantId = $this->currentTenantIdFromSession();
         $this->rememberMeService->forgetCurrentUser();
-        Auth::logout();
+        $this->logoutWithModuleCleanup();
         $this->recordAuthEvent('auth.logout', 'success', [
             'actor_user_id' => $actorUserId > 0 ? $actorUserId : null,
             'actor_tenant_id' => $actorTenantId > 0 ? $actorTenantId : null,
@@ -290,7 +290,7 @@ class AuthService
         $actorTenantId = $this->currentTenantIdFromSession();
         $this->sessionStore->remove('session_started_at');
         $this->sessionStore->remove('session_last_activity');
-        Auth::logout();
+        $this->logoutWithModuleCleanup();
         $this->recordAuthEvent('auth.session.timeout', 'success', [
             'actor_user_id' => $actorUserId > 0 ? $actorUserId : null,
             'actor_tenant_id' => $actorTenantId > 0 ? $actorTenantId : null,
@@ -413,4 +413,10 @@ class AuthService
     {
         return (bool) $this->sessionStore->get('no_active_tenant', false);
     }
+
+    private function logoutWithModuleCleanup(): void
+    {
+        $this->authSessionTenantContextService->clearModuleSessionData();
+        Auth::logout();
+    }
 }