docs(website): record slice 4, and the §5.2 check as built

MODULE_SYSTEM.md §2.7.1 gains the slice 4 record: the 190 dead lines of UO API
bindings slice 3 left behind (with zero consumers, which is why nothing caught
them), the copy rewrite and why the words stay in code rather than becoming a
config surface, the two settings rows core had no business seeding, and the
check that keeps all of it out. The slice table row is corrected to what
actually moved, and README.md is recorded as deliberately deferred to slice 5
rather than quietly skipped.

The defect gets its own subsection with the SQL, because it is a shape that will
recur: a guard in core and the statement it guards in a fragment run in the wrong
order, since core's schema is replayed in full before any fragment. Verified
against a real MariaDB in all three states, including the pinned-instance case
that makes it a one-shot rather than a re-bump.

MODULE_API.md §5.2 stops describing a grep and describes what was built — four
details promoted to contract because each was wrong first: whole-word matching
(a substring pass flags `defaultImage`, which contains "ultIma"), the
comments-then-strings character walk, grandfathering exemptions that fail the
build when they stop matching, and `git ls-files` over a directory walk.

BACKEND_DESIGN.md's settings table gains the keys a MODULE seeds, and the
ordering rule behind them.

Co-Authored-By: Claude <noreply@anthropic.com>

website/BACKEND_DESIGN.md

@@ -274,7 +274,17 @@ Seeded with the 8 spec categories: `new-player-guide, maps-atlas, systems, items
 
 Seeded keys: `site_mode` (default `maintenance`), `site_mode_changed_at`,
 `site_mode_changed_by`, `maintenance_message`, `status_message`, `homepage_teaser`,
-`contact_email` (=UOMysticmoon@gmail.com), `site_title`.
+`contact_email` (=UOMysticmoon@gmail.com), `site_title`, `player_registration`
+(default `disabled`), `mobile_app_links_enabled`.
+
+**Keys a MODULE seeds into this table.** `settings` is core's, but a module's
+schema fragment may `INSERT IGNORE` its own rows into it, and module-uo seeds two:
+`game_account_signup` (default `disabled`) and the one-shot migration marker
+`uo_link_protocol_3_migrated`. Core seeded both until Phase 3 slice 4, which is
+worth knowing for one reason beyond tidiness — a fragment runs **after** core's
+schema is replayed in full, so a marker in core guarding a statement in a fragment
+fires before the statement reads it. That exact ordering silently disabled the
+protocol-3 migration between slices 1 and 4; see MODULE_SYSTEM.md §2.7.1.
 
 **Deliberately unseeded keys** — the theming & navigation overrides
 (`theme_visual`, `brand_assets`, `nav_public`, `nav_admin`, `nav_player`). All