feat: add module registry and versioning

[playmaker410]

Summary

• add persistent module and tenant-state registry models with migration
• add admin-protected registration, compatibility, enable, disable, state resolution, upgrade, and deregistration flows
• add transactional lifecycle hooks with rollback coverage
• add a runtime-safe example grant module, Docker packaging, documentation, and reviewer checklist
• add unit, migration, controller, loader, and end-to-end coverage
• correct the alert test fixture and circular module dependency discovered during validation

Testing

• npm run build
• npx tsc --noEmit -p tsconfig.json
• npx tsc --noEmit -p test/tsconfig.json
• module registry unit tests: 19 passed
• module registry and alert end-to-end tests: 13 passed

Closes #125