feat: extend module platform with UI slots, runtime components, CLI tooling and {{userId}} search support

Completes the generic module platform that enables modules to contribute
UI elements, runtime JS components, and search resources without any
core hardcoding.

New generic UI slot types:
- topbar.right_item: module-contributed topbar buttons
- layout.body_end_template: module-contributed dialog/overlay templates
- layout.head_style: module-contributed global CSS
- runtime.component: declarative JS component registration with phase ordering

New infrastructure:
- ModuleAutoloader: PSR-4 autoloading for module-local PHP classes
- ModuleRuntimePageBuilder: symlinks module pages into runtime directory
- ModuleRuntimeAssetPublisher: publishes module CSS/JS to web/modules/
- ModulePermissionSynchronizer: syncs module permissions to DB
- CLI scripts: module-runtime-sync, module-build, module-migrate,
  module-permissions-sync, module-assets-sync
- {{userId}} placeholder in SearchDataService for user-scoped search queries
- Component runtime with phased initialization (early/default/late)
- AppContainer.protectExistingBindings() to prevent module→core overwrites
- Architecture tests: ModuleStructureContractTest, CoreTemplateIsolationTest,
  FrontendComponentRuntimeContractTest, AppContainerIsolationContractTest

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

web/js/components/app-password-toggle.js

@@ -1,13 +1,23 @@
 /**
  * Show/hide password toggle button injected next to password inputs.
  */
-export function initPasswordToggles() {
-  const inputs = document.querySelectorAll('input[type="password"]');
-  if (!inputs.length) {return;}
+import { resolveHost } from '../core/app-dom.js';
+
+export function initPasswordToggles(root = document, options = {}) {
+  const selector = String(options.selector || 'input[type="password"]').trim() || 'input[type="password"]';
+  const host = resolveHost(root);
+  const inputs = Array.from(host.querySelectorAll(selector));
+  if (!inputs.length) {
+    return { destroy: () => {} };
+  }
 
   const showLabel = (document.documentElement.dataset.passwordToggleShowLabel || '').trim();
   const hideLabel = (document.documentElement.dataset.passwordToggleHideLabel || '').trim();
-  if (!showLabel || !hideLabel) {return;}
+  if (!showLabel || !hideLabel) {
+    return { destroy: () => {} };
+  }
+
+  const cleanupFns = [];
 
   inputs.forEach((input) => {
     if (!(input instanceof HTMLInputElement)) {return;}
@@ -23,6 +33,10 @@ export function initPasswordToggles() {
         input.dataset.passwordToggleBound = '1';
         existingToggle.dataset.passwordToggleBound = '1';
         existingToggle.setAttribute('aria-label', input.type === 'password' ? showLabel : hideLabel);
+        cleanupFns.push(() => {
+          delete input.dataset.passwordToggleBound;
+          delete existingToggle.dataset.passwordToggleBound;
+        });
         return;
       }
     }
@@ -46,18 +60,24 @@ export function initPasswordToggles() {
     input.dataset.passwordToggleBound = '1';
     toggle.dataset.passwordToggleBound = '1';
 
-    toggle.addEventListener('click', () => {
+    const onToggleClick = () => {
       const isPassword = input.type === 'password';
       input.type = isPassword ? 'text' : 'password';
       icon.className = isPassword ? 'bi bi-eye-slash' : 'bi bi-eye';
       toggle.setAttribute('aria-label', isPassword ? hideLabel : showLabel);
       input.focus();
+    };
+    toggle.addEventListener('click', onToggleClick);
+    cleanupFns.push(() => {
+      toggle.removeEventListener('click', onToggleClick);
+      delete input.dataset.passwordToggleBound;
+      delete toggle.dataset.passwordToggleBound;
     });
   });
-}
 
-if (document.readyState === 'loading') {
-  document.addEventListener('DOMContentLoaded', initPasswordToggles);
-} else {
-  initPasswordToggles();
+  const destroy = () => {
+    cleanupFns.forEach((cleanup) => cleanup());
+  };
+
+  return { destroy };
 }