feat(modules): the declarative Docker path (phase 4, slice 3)

MODULES declares the module set a deployment runs, one entry per module as
`<id>@<version>=<install manifest URL>`, and the container arrives at it by
itself (MODULE_SYSTEM.md §2.7.2 decision 4). A module already unpacked at the
declared version is a no-op that makes NO network call, so a restart with the
network down comes up unchanged; anything else goes through install.js — same
allowlist, same sha256, same inspect-then-extract — and install() now takes an
`expect: {id, version}` so a URL resolving to another module or version is
refused while it is still only a manifest.

Resolution runs inside start(), between the seed and the require of app.js: the
seed is where the host allowlist setting comes from, and the require is what
scans the volume. That buys it the database, so a compose-installed module gets
the same provenance columns an admin install writes.

A failure is logged and carried, never fatal — an unreachable release host must
not take the site down. The declaration owns what is on the volume; the row owns
whether a module runs, so uninstalling a declared module returns its files at
the next start and leaves it disabled. The admin list gains that as a fourth
source (declared / declaredVersion / declaredError), because a declared module
that failed to resolve has no row, no directory and nothing mounted.

Deferring the app require moved core's schema ahead of the volume scan, and the
module schema-fragment replay was wired to core's schema — so every installed
module silently got no tables. Invisible to the suite (each one stubs the loader
or the pool) and to a smoke on a database that already had the tables; found by
booting against an empty one. ensureSchema() now takes `replayModules: false`
for the one caller that scans later, server.js replays them itself after the
require, and a bootOrder test pins the five steps in the only order they work in.

741 server tests (+18), 187 client (+5); manifest unchanged at 166 public + 2
internal, OpenAPI byte-identical.

Co-Authored-By: Claude <noreply@anthropic.com>

client/test/moduleAdmin.test.js

@@ -1,6 +1,6 @@
 import { test } from 'node:test'
 import assert from 'node:assert/strict'
-import { statusOf, actionsFor, needsRestart, parseHosts } from '../src/lib/moduleAdmin.js'
+import { statusOf, actionsFor, declarationNoteFor, needsRestart, parseHosts } from '../src/lib/moduleAdmin.js'
 
 // lib/moduleAdmin.js — what the Modules screen says about a module and what it
 // lets you do to it. Phase 4, slice 2 of MODULE_SYSTEM.md §2.7.2.
@@ -28,6 +28,9 @@ const mod = (over = {}) => ({
   capabilities: [],
   onVolume: true,
   canPurge: true,
+  declared: false,
+  declaredVersion: null,
+  declaredError: null,
   ...over,
 })
 
@@ -224,3 +227,55 @@ test('parseHosts previews exactly what the server will store', () => {
   assert.deepEqual(parseHosts('  '), [])
   assert.deepEqual(parseHosts(undefined), [])
 })
+
+// ── the declaration (slice 3) ──────────────────────────────────────────────
+
+test('a declared module that has never installed says so, with the reason', () => {
+  // No row, no directory, nothing mounted — invisible to the other three
+  // sources, so without this branch the screen would describe a module it has
+  // never had as a row gone stale.
+  const s = statusOf(mod({
+    state: null,
+    liveState: null,
+    liveVersion: null,
+    version: null,
+    onVolume: false,
+    declared: true,
+    declaredVersion: '0.3.0',
+    declaredError: 'could not reach releases.example.com',
+  }))
+  assert.equal(s.label, 'Declared, not installed')
+  assert.equal(s.tone, 'bad')
+  assert.equal(s.pending, false, 'a restart will not fix an unreachable host')
+  assert.match(s.detail, /could not reach releases.example.com/)
+})
+
+test('a declared module waiting for its first resolution is not reported as failed', () => {
+  const s = statusOf(mod({ state: null, liveState: null, version: null, onVolume: false, declared: true, declaredVersion: '0.3.0' }))
+  assert.match(s.detail, /installed when the server next starts/)
+})
+
+test('a running module whose declared upgrade is failing is still Running', () => {
+  // Both facts are true at once. The status is one label, so the declaration
+  // gets its own line rather than overwriting it.
+  const m = mod({ declared: true, declaredVersion: '2.0.0', declaredError: 'sha256 did not match' })
+  assert.equal(statusOf(m).label, 'Running')
+  const note = declarationNoteFor(m)
+  assert.equal(note.tone, 'warn')
+  assert.match(note.text, /sha256 did not match/)
+})
+
+test('uninstalling a declared module is told that its files come back', () => {
+  // The sentence that saves an afternoon: MODULES owns what is on the volume,
+  // the row owns whether it runs.
+  const note = declarationNoteFor(mod({ state: 'disabled', liveState: null, onVolume: false, declared: true, declaredVersion: '1.0.0' }))
+  assert.match(note.text, /come back when the server next starts/)
+  assert.match(note.text, /switched off/)
+})
+
+test('an ordinary declared module gets a quiet note, and an undeclared one none', () => {
+  assert.equal(declarationNoteFor(mod()), null)
+  const note = declarationNoteFor(mod({ declared: true, declaredVersion: '1.0.0' }))
+  assert.equal(note.tone, 'idle')
+  assert.match(note.text, /MODULES/)
+})