feat(modules): the declarative Docker path (phase 4, slice 3)

MODULES declares the module set a deployment runs, one entry per module as
`<id>@<version>=<install manifest URL>`, and the container arrives at it by
itself (MODULE_SYSTEM.md §2.7.2 decision 4). A module already unpacked at the
declared version is a no-op that makes NO network call, so a restart with the
network down comes up unchanged; anything else goes through install.js — same
allowlist, same sha256, same inspect-then-extract — and install() now takes an
`expect: {id, version}` so a URL resolving to another module or version is
refused while it is still only a manifest.

Resolution runs inside start(), between the seed and the require of app.js: the
seed is where the host allowlist setting comes from, and the require is what
scans the volume. That buys it the database, so a compose-installed module gets
the same provenance columns an admin install writes.

A failure is logged and carried, never fatal — an unreachable release host must
not take the site down. The declaration owns what is on the volume; the row owns
whether a module runs, so uninstalling a declared module returns its files at
the next start and leaves it disabled. The admin list gains that as a fourth
source (declared / declaredVersion / declaredError), because a declared module
that failed to resolve has no row, no directory and nothing mounted.

Deferring the app require moved core's schema ahead of the volume scan, and the
module schema-fragment replay was wired to core's schema — so every installed
module silently got no tables. Invisible to the suite (each one stubs the loader
or the pool) and to a smoke on a database that already had the tables; found by
booting against an empty one. ensureSchema() now takes `replayModules: false`
for the one caller that scans later, server.js replays them itself after the
require, and a bootOrder test pins the five steps in the only order they work in.

741 server tests (+18), 187 client (+5); manifest unchanged at 166 public + 2
internal, OpenAPI byte-identical.

Co-Authored-By: Claude <noreply@anthropic.com>

server/.env.example

@@ -143,5 +143,24 @@ ANNOUNCE_POLL_MS=15000
 #                        deployment does nothing, deliberately, so a redeploy cannot
 #                        silently undo an operator's choice. Installs are https-only
 #                        and an empty list forbids all of them.
+#   MODULES              The module set this deployment RUNS, resolved at every
+#                        start (§2.7.2 decision 4). One entry per module, separated
+#                        by whitespace or commas:
+#
+#                            <id>@<version>=<install manifest URL>
+#
+#                        A module already unpacked at the declared version is left
+#                        alone WITHOUT touching the network, so a restart with no
+#                        route to the internet comes up unchanged; only a missing or
+#                        different version is fetched, through the same verify-and-
+#                        unpack path (and the same host allowlist) the admin panel
+#                        uses. A version that cannot be fetched is logged and shown
+#                        in Admin → Modules — it never stops the site from starting.
+#
+#                        This variable owns what is ON the volume, not what runs: a
+#                        module disabled from the admin panel stays disabled even
+#                        though its files are put back. Leave it unset to manage
+#                        modules entirely from the admin panel.
 # MODULES_DIR=/app/modules
 # MODULE_SOURCE_HOSTS=gitea.whitlocktech.com
+# MODULES=uo@0.3.0=https://gitea.whitlocktech.com/RunicGateway/Module-uo/releases/download/v0.3.0/module-uo-0.3.0.json