feat: extend module platform with UI slots, runtime components, CLI tooling and {{userId}} search support

Completes the generic module platform that enables modules to contribute
UI elements, runtime JS components, and search resources without any
core hardcoding.

New generic UI slot types:
- topbar.right_item: module-contributed topbar buttons
- layout.body_end_template: module-contributed dialog/overlay templates
- layout.head_style: module-contributed global CSS
- runtime.component: declarative JS component registration with phase ordering

New infrastructure:
- ModuleAutoloader: PSR-4 autoloading for module-local PHP classes
- ModuleRuntimePageBuilder: symlinks module pages into runtime directory
- ModuleRuntimeAssetPublisher: publishes module CSS/JS to web/modules/
- ModulePermissionSynchronizer: syncs module permissions to DB
- CLI scripts: module-runtime-sync, module-build, module-migrate,
  module-permissions-sync, module-assets-sync
- {{userId}} placeholder in SearchDataService for user-scoped search queries
- Component runtime with phased initialization (early/default/late)
- AppContainer.protectExistingBindings() to prevent module→core overwrites
- Architecture tests: ModuleStructureContractTest, CoreTemplateIsolationTest,
  FrontendComponentRuntimeContractTest, AppContainerIsolationContractTest

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

pages/admin/users/edit($id).php

@@ -68,7 +68,6 @@ $canEditAssignments = (bool) ($capabilities['can_edit_assignments'] ?? false);
 $canManageTenants = (bool) ($capabilities['can_manage_tenants'] ?? false);
 $canEditCustomFieldValues = (bool) ($capabilities['can_edit_custom_field_values'] ?? false);
 $canManageApiTokens = (bool) ($capabilities['can_manage_api_tokens'] ?? false);
-$canViewAddressBook = (bool) ($capabilities['can_view_address_book'] ?? false);
 $canViewUserMeta = (bool) ($capabilities['can_view_user_meta'] ?? false);
 $canViewUserAudit = (bool) ($capabilities['can_view_user_audit'] ?? false);
 $canAccessPdf = (bool) ($capabilities['can_access_pdf'] ?? false);