feat: extend module platform with UI slots, runtime components, CLI tooling and {{userId}} search support

Completes the generic module platform that enables modules to contribute
UI elements, runtime JS components, and search resources without any
core hardcoding.

New generic UI slot types:
- topbar.right_item: module-contributed topbar buttons
- layout.body_end_template: module-contributed dialog/overlay templates
- layout.head_style: module-contributed global CSS
- runtime.component: declarative JS component registration with phase ordering

New infrastructure:
- ModuleAutoloader: PSR-4 autoloading for module-local PHP classes
- ModuleRuntimePageBuilder: symlinks module pages into runtime directory
- ModuleRuntimeAssetPublisher: publishes module CSS/JS to web/modules/
- ModulePermissionSynchronizer: syncs module permissions to DB
- CLI scripts: module-runtime-sync, module-build, module-migrate,
  module-permissions-sync, module-assets-sync
- {{userId}} placeholder in SearchDataService for user-scoped search queries
- Component runtime with phased initialization (early/default/late)
- AppContainer.protectExistingBindings() to prevent module→core overwrites
- Architecture tests: ModuleStructureContractTest, CoreTemplateIsolationTest,
  FrontendComponentRuntimeContractTest, AppContainerIsolationContractTest

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

web/js/components/app-auto-submit.js

@@ -2,11 +2,38 @@
  * Auto-submit: submits the parent form when a [data-auto-submit] element changes.
  * Replaces inline onchange="this.form.submit()" handlers for CSP compliance.
  */
-document.querySelectorAll('[data-auto-submit]').forEach((element) => {
-  element.addEventListener('change', () => {
-    const form = element.closest('form');
-    if (form) {
-      form.submit();
+import { resolveHost } from '../core/app-dom.js';
+
+export function initAutoSubmit(root = document, options = {}) {
+  const selector = String(options.selector || '[data-auto-submit]').trim() || '[data-auto-submit]';
+  const host = resolveHost(root);
+  const elements = Array.from(host.querySelectorAll(selector));
+  if (!elements.length) {
+    return { destroy: () => {} };
+  }
+
+  const cleanupFns = [];
+  elements.forEach((element) => {
+    if (!(element instanceof HTMLElement) || element.dataset.autoSubmitBound === '1') {
+      return;
     }
+    element.dataset.autoSubmitBound = '1';
+    const onChange = () => {
+      const form = element.closest('form');
+      if (form instanceof HTMLFormElement) {
+        form.submit();
+      }
+    };
+    element.addEventListener('change', onChange);
+    cleanupFns.push(() => {
+      element.removeEventListener('change', onChange);
+      delete element.dataset.autoSubmitBound;
+    });
   });
-});
+
+  const destroy = () => {
+    cleanupFns.forEach((cleanup) => cleanup());
+  };
+
+  return { destroy };
+}