feat: extend module platform with UI slots, runtime components, CLI tooling and {{userId}} search support

Completes the generic module platform that enables modules to contribute
UI elements, runtime JS components, and search resources without any
core hardcoding.

New generic UI slot types:
- topbar.right_item: module-contributed topbar buttons
- layout.body_end_template: module-contributed dialog/overlay templates
- layout.head_style: module-contributed global CSS
- runtime.component: declarative JS component registration with phase ordering

New infrastructure:
- ModuleAutoloader: PSR-4 autoloading for module-local PHP classes
- ModuleRuntimePageBuilder: symlinks module pages into runtime directory
- ModuleRuntimeAssetPublisher: publishes module CSS/JS to web/modules/
- ModulePermissionSynchronizer: syncs module permissions to DB
- CLI scripts: module-runtime-sync, module-build, module-migrate,
  module-permissions-sync, module-assets-sync
- {{userId}} placeholder in SearchDataService for user-scoped search queries
- Component runtime with phased initialization (early/default/late)
- AppContainer.protectExistingBindings() to prevent module→core overwrites
- Architecture tests: ModuleStructureContractTest, CoreTemplateIsolationTest,
  FrontendComponentRuntimeContractTest, AppContainerIsolationContractTest

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

web/js/app-boot.js

@@ -12,19 +12,36 @@
   root.classList.add('js');
   root.classList.add('aside-pending');
 
-  var assetBase = root.dataset.assetBase || '';
-  if (assetBase) {
-    window.APP_ASSET_BASE = assetBase;
-  }
+  var normalizeToken = function (value) {
+    return String(value == null ? '' : value)
+      .trim()
+      .toLowerCase()
+      .replace(/[^a-z0-9._-]+/g, '-')
+      .replace(/^-+|-+$/g, '');
+  };
+  var buildStorageKey = function (scope, key) {
+    var namespace = normalizeToken('app-ui') || 'app-ui';
+    var version = normalizeToken('v1') || 'v1';
+    var normalizedScope = normalizeToken(scope || '') || 'global';
+    var normalizedKey = normalizeToken(key || '');
+    if (!normalizedKey) {
+      return '';
+    }
+    return namespace + ':' + version + ':' + normalizedScope + ':state:' + normalizedKey;
+  };
 
   try {
-    if (window.localStorage.getItem('app-sidebar-collapsed') === '1') {
+    var sidebarCollapsedKey = buildStorageKey('sidebar', 'sidebar-collapsed');
+    var sidebarHiddenKey = buildStorageKey('sidebar', 'sidebar-hidden');
+    var contrastKey = buildStorageKey('contrast', 'contrast-mode');
+
+    if (sidebarCollapsedKey && window.localStorage.getItem(sidebarCollapsedKey) === '1') {
       root.classList.add('sidebar-collapsed');
     }
-    if (window.localStorage.getItem('app-sidebar-hidden') === '1') {
+    if (sidebarHiddenKey && window.localStorage.getItem(sidebarHiddenKey) === '1') {
       root.classList.add('sidebar-hidden');
     }
-    var contrastValue = window.localStorage.getItem('app-contrast');
+    var contrastValue = contrastKey ? window.localStorage.getItem(contrastKey) : null;
     if (contrastValue === 'high') {
       root.dataset.contrast = 'high';
     } else {
@@ -33,16 +50,4 @@
   } catch (e) {
     // ignore storage errors
   }
-
-  if (typeof window.requestFsLightboxRefresh !== 'function') {
-    window.requestFsLightboxRefresh = function () {
-      if (typeof window.refreshFsLightbox === 'function') {
-        window.refreshFsLightbox();
-        window.__fsLightboxRefreshPending = false;
-        return true;
-      }
-      window.__fsLightboxRefreshPending = true;
-      return false;
-    };
-  }
 })();