docs(modules): close Phase 4 — de-UO the backend reference, record the acceptance run

Phase 4 slice 4. BACKEND_DESIGN.md had never been de-UO'd: Phase 3 rewrote core's
code and README, but §5.2's identifier check reads code, not prose, so nothing
ever looked at the design document. It still described 27 shard_* tables, 20 UO
route rows and the shard visibility ladder as core's, a phase after core stopped
being able to serve any of them.

Moved, text unchanged:

  BACKEND_DESIGN §3   six shard_* schema sections (226 lines) → modules/uo/SCHEMA.md
  BACKEND_DESIGN §4   13 public + 7 admin UO route rows       → modules/uo/API.md
  BACKEND_DESIGN §6.5 the audience ladder (70 lines)          → modules/uo/API.md §4

Core keeps the seam and gains the eight /admin/modules routes it had never
documented. §6.5 becomes "Module-owned audience boundaries": core's security
boundary ends at authentication, roles and the session, and a module that serves
game data brings its own.

Also fixed on the way: users.router.js was still listed as 15 routes (it is 9 —
six went to the extension slot), and the push section still promised
config/shardStreams.js "moves out with it" four slices after it left.

The acceptance table now carries results. Criterion 2 was proved for real against
module-uo v0.3.0 on an empty database, which turned up the uninstall ordering
defect fixed in website#146.

AI disclosure: this contribution was AI-assisted (Claude Code).

Co-Authored-By: Claude <noreply@anthropic.com>

website/SHARD_VISIBILITY.md

@@ -3,7 +3,9 @@
 **Status:** Built (Protocol 3.0 Part A). Admin → Shard Visibility.
 **Audience:** shard owners and admins.
 **Companion to** [`../link/v3.md`](../link/v3.md) §3 (the design) and
-[`BACKEND_DESIGN.md`](BACKEND_DESIGN.md) §6 (the security contract).
+[`../modules/uo/API.md`](../modules/uo/API.md) §4 (the enforcement contract — it moved there with the
+rest of module-uo's surface; core's [`BACKEND_DESIGN.md`](BACKEND_DESIGN.md) §6 keeps the security
+contract core still owns).
 
 The website surfaces a lot of live shard data. What your players, your staff and the anonymous
 internet may each see is **yours to decide**, per feature, from Admin → Shard Visibility.