docs(website): add the module API contract (phase 1)

The normative contract between core and an installed module: the `ctx` handed
to a module's entry point, the `register*` calls, the client-side registry and
shared-dependency global, the schema-fragment rules, and the loader's
validation and failure obligations. Every member is derived from what the UO
code actually imports today, re-read against the working tree.

Part 6 records four places the survey contradicted MODULE_SYSTEM.md:

  • OpenAPI generation is STATIC analysis (swagger-autogen parses app.js as
    text), unlike routeManifest.js which walks the live Express stack. A
    filesystem-scanning loader is invisible to it, so module routes would be
    silently absent from swagger-output.json. Three options, one recommended;
    needs a decision before Phase 2.
  • The client contract is much larger than §2.1 implies — the atlas pages
    import five core modules beyond React, so the plan needs a curated UI kit
    and a request primitive on window.__rg.
  • shardVisibility is module-owned and the atlas depends on it, so the spike
    carries it; two copies coexist during the spike by design.
  • Two counts corrected: 27 UO tables (not 25), 6 atlas routes (not 5).

MODULE_SYSTEM.md gains a pointer to the contract and the corrected table count.

Co-Authored-By: Claude <noreply@anthropic.com>

website/MODULE_SYSTEM.md

@@ -4,6 +4,10 @@
 org lead; Part 1 records what was verified against the working trees on 2026-08-10, including the
 places the original draft was wrong.
 
+**The normative contract is [`MODULE_API.md`](MODULE_API.md)** (Phase 1). This document decides what
+the module system *is*; that one decides exactly what a module may call. Where the two differ, that
+one wins — its Part 6 lists the four places it amends this document.
+
 **Goal.** Turn Runic Gateway from a UO/ServUO-specific platform into a game-agnostic one. The core
 architecture is unchanged — sidecar → website → browser. What changes is that game-specific
 behaviour (routes, tables, screens, nav) leaves the core website and becomes an installable
@@ -120,7 +124,9 @@ replayed; **purge** is a separate, explicit, destructive admin action that runs
 `purge.sql`. A real migration runner, covering core *and* modules together, is a legitimate future
 workstream; it is not a prerequisite for this one.
 
-Twenty-five of the 67 tables move with the module: the 24 `shard_*` tables plus `uo_link_config`.
+Twenty-seven of the tables move with the module: the 26 `shard_*` tables plus `uo_link_config`.
+(This said 25 when written; the working tree was recounted in Phase 1 — see
+[`MODULE_API.md`](MODULE_API.md) §6.4.)
 
 ### 1.7 Boot and shutdown is a lifecycle gap
 
@@ -378,11 +384,13 @@ Phase 1 prototypes exactly this before anything is committed to it (§2.7).
 Nothing else can be trusted until the first of these is done.
 
 **Phase 1 — API contract + spike (blocking).** Merge this document. Write the contract at
-`docs/website/MODULE_API.md`. Then a throwaway spike on an unmerged branch moving
-**`/api/v1/public/atlas/*`** behind the proposed surface — the smallest honest test: five routes,
-DB-backed, no sidecar, no SSE, one boot hook. The spike must *also* prove the §2.6 chunk load end to
-end, since that is the highest-risk decision in the plan. Exit criteria: no internal-file imports,
-`npm run routes:manifest` produces a zero-line diff, and the chunk loads under the enforced CSP.
+[`docs/website/MODULE_API.md`](MODULE_API.md) — **done**; it amends this document in four places,
+listed in its Part 6, one of which (OpenAPI generation, §6.1 there) needs a decision before Phase 2
+starts. Then a throwaway spike on an unmerged branch moving **`/api/v1/public/atlas/*`** behind the
+proposed surface — the smallest honest test: six routes, DB-backed, no sidecar, no SSE, one boot
+hook. The spike must *also* prove the §2.6 chunk load end to end, since that is the highest-risk
+decision in the plan. Exit criteria: no internal-file imports, `npm run routes:manifest` produces a
+zero-line diff, and the chunk loads under the enforced CSP.
 
 **Phase 2 — Core scaffolding, no behaviour change.** One PR each, in order:
 
@@ -499,6 +507,7 @@ Conventional Commits, the AI-disclosure trailer, branches cut from an up-to-date
 | 2 | Website and installer stay independent; delivery is website-side only | §1.11, §2.5 |
 | 3 | Core declares an extension slot on `/admin/users/:id`; all six URLs preserved | §1.9 |
 | 4 | Phase 1 spike targets `/api/v1/public/atlas/*` | §2.7 |
+| 4a | The contract lives in [`MODULE_API.md`](MODULE_API.md); it is normative where the two differ | §2.7 |
 | 5 | Install surfaces: admin panel and the Docker environment; never a build step | §2.5 |
 | 6 | One repo, one bundle — server and client halves version together | §2.3 |
 | 7 | Android app is a separate plan; core owes it `/api/v1/public/modules` | §2.5, §2.7 |