feat(modules): the declarative Docker path (phase 4, slice 3)

MODULES declares the module set a deployment runs, one entry per module as
`<id>@<version>=<install manifest URL>`, and the container arrives at it by
itself (MODULE_SYSTEM.md §2.7.2 decision 4). A module already unpacked at the
declared version is a no-op that makes NO network call, so a restart with the
network down comes up unchanged; anything else goes through install.js — same
allowlist, same sha256, same inspect-then-extract — and install() now takes an
`expect: {id, version}` so a URL resolving to another module or version is
refused while it is still only a manifest.

Resolution runs inside start(), between the seed and the require of app.js: the
seed is where the host allowlist setting comes from, and the require is what
scans the volume. That buys it the database, so a compose-installed module gets
the same provenance columns an admin install writes.

A failure is logged and carried, never fatal — an unreachable release host must
not take the site down. The declaration owns what is on the volume; the row owns
whether a module runs, so uninstalling a declared module returns its files at
the next start and leaves it disabled. The admin list gains that as a fourth
source (declared / declaredVersion / declaredError), because a declared module
that failed to resolve has no row, no directory and nothing mounted.

Deferring the app require moved core's schema ahead of the volume scan, and the
module schema-fragment replay was wired to core's schema — so every installed
module silently got no tables. Invisible to the suite (each one stubs the loader
or the pool) and to a smoke on a database that already had the tables; found by
booting against an empty one. ensureSchema() now takes `replayModules: false`
for the one caller that scans later, server.js replays them itself after the
require, and a bootOrder test pins the five steps in the only order they work in.

741 server tests (+18), 187 client (+5); manifest unchanged at 166 public + 2
internal, OpenAPI byte-identical.

Co-Authored-By: Claude <noreply@anthropic.com>

client/src/routes/admin/views/ModulesAdmin.jsx

@@ -1,7 +1,7 @@
 import { useCallback, useEffect, useState } from 'react'
 import { Loading, ErrorState } from '../../../components/PageState.jsx'
 import { dateTime } from '../../../lib/format.js'
-import { statusOf, actionsFor, needsRestart, parseHosts } from '../../../lib/moduleAdmin.js'
+import { statusOf, actionsFor, declarationNoteFor, needsRestart, parseHosts } from '../../../lib/moduleAdmin.js'
 import { api } from '../../../api/client.js'
 
 // Installed modules: install from a release URL, enable, disable, uninstall,
@@ -226,6 +226,7 @@ function ModuleRow({ m, onChanged, onError }) {
   const [busy, setBusy] = useState('')
   const status = statusOf(m)
   const actions = actionsFor(m)
+  const note = declarationNoteFor(m)
 
   async function run(name, fn) {
     setBusy(name)
@@ -272,7 +273,9 @@ function ModuleRow({ m, onChanged, onError }) {
       <td className="adm-td" style={{ color: 'var(--text)' }}>
         <div style={{ fontWeight: 600 }}>{m.name}</div>
         <div className="dim" style={{ fontSize: '0.76rem' }}>
-          {m.id} · v{m.version}
+          {/* A declared module that has never installed has no version to show —
+              only the one MODULES asks for, which the status column carries. */}
+          {m.id}{m.version ? ` · v${m.version}` : ''}
         </div>
         {m.capabilities?.length > 0 && (
           <div className="dim" style={{ fontSize: '0.72rem', marginTop: 2 }}>{m.capabilities.join(' · ')}</div>
@@ -282,18 +285,37 @@ function ModuleRow({ m, onChanged, onError }) {
       <td className="adm-td">
         <Pill tone={status.tone}>{status.label}</Pill>
         <div className="dim" style={{ fontSize: '0.74rem', marginTop: 4, maxWidth: 380 }}>{status.detail}</div>
+        {/* The environment's declaration, on its own line: a module can be
+            running fine while its declared upgrade is failing, and the status
+            above can only be one of those two things. */}
+        {note && (
+          <div
+            style={{
+              fontSize: '0.74rem',
+              marginTop: 4,
+              maxWidth: 380,
+              color: note.tone === 'warn' ? TONE.warn : 'var(--muted)',
+            }}
+          >
+            {note.text}
+          </div>
+        )}
       </td>
 
       <td className="adm-td dim" style={{ fontSize: '0.74rem' }}>
         {/* Provenance. Null for a directory placed on the volume by hand, which
-            stays a supported install — so it is shown as that, not as missing. */}
+            stays a supported install — so it is shown as that, not as missing.
+            A declared module can also reach a boot with no provenance: the
+            no-op path never fetches, so it has no sha256 to record and no
+            reason to write a row. Saying "by hand" there would be the one
+            wrong answer. */}
         {m.source ? (
           <>
             <div style={{ wordBreak: 'break-all', maxWidth: 260 }}>{m.source}</div>
             {m.sha256 && <div style={{ marginTop: 2 }}>sha256 {m.sha256.slice(0, 12)}…</div>}
           </>
         ) : (
-          <span>Placed on the volume by hand</span>
+          <span>{m.declared ? 'From the declared module set' : 'Placed on the volume by hand'}</span>
         )}
         {m.installedAt && <div style={{ marginTop: 2 }}>{dateTime(m.installedAt)}</div>}
       </td>