feat: standalone module-build readiness for the public @ekklesia packages (ADR 0053)

Makes the public module-development package set usable from a module
repository outside the monorepo. Nothing is published.

- Curated @ekklesia/module-sdk: an explicit author API, no contracts
  barrel, no identity/authorization internals, no Drizzle and no legacy
  ModuleDatabase type. defineModuleRuntime returns the SDK's own named
  interfaces so a module's emitted declarations never reach into
  @ekklesia/contracts. defineModuleSchema is gone; createModuleTable and
  defineModuleSchemaMetadata live in @ekklesia/module-database.
- Drizzle: no longer a dependency of module-sdk or contracts. Core keeps
  the legacy Drizzle schema validator (moved to core/src/modules) and
  its legacy runtime support; drizzle-orm is an optional peer only.
- React is a peer (plus devDependency) of @ekklesia/ui; the boundary
  checker allows exactly that consumer-selected peer.
- @ekklesia/typescript-config is publishable; module-ui-host is private.
  Every public package carries "ekklesia.distribution":
  "module-development" and no monorepo-root prepack.
- module-pack reads the Node.js range from the module's own engines.node
  and recognizes Ekklesia packages by name plus that marker, so
  registry-installed packages are incorporated, SDK-compatibility
  checked, and never credited as third-party.
- scripts/pack-public-packages.ts (pnpm packages:pack) rebuilds, packs
  and inspects the nine public tarballs; scripts/test-standalone-module.sh
  (pnpm test:standalone-module, new CI job) installs them into a fixture
  module outside the repository and proves it typechecks, builds,
  packages, and verifies.
- Public-package boundary tests and module-development docs.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

packages/ui/tests/tokens.test.ts

@@ -65,13 +65,18 @@ describe("the shared elements consume design tokens, never hardcoded theme value
   it("depends only on the design tokens and React", async () => {
     const manifest = JSON.parse(
       await readFile(path.join(packageDirectory, "package.json"), "utf8"),
-    ) as { dependencies?: Record<string, string>; peerDependencies?: Record<string, string> };
+    ) as {
+      dependencies?: Record<string, string>;
+      devDependencies?: Record<string, string>;
+      peerDependencies?: Record<string, string>;
+    };
 
-    // React is both a production dependency and a peer: the peer states that the consumer's React
-    // must be the same one, and the production declaration is what makes the package's own imports
-    // resolve, since a consumer never satisfies a linked workspace package's peer
-    // (`runtime-imports-are-production-dependencies`).
-    expect(Object.keys(manifest.dependencies ?? {})).toEqual(["@ekklesia/design-tokens", "react"]);
+    // React is a peer only (ADR 0053): the consumer's React is the one in every bundle these
+    // elements are built into. The development dependency resolves the package's own imports for its
+    // builds and tests; nothing loads it from this workspace in a production Node.js process
+    // (`runtime-imports-are-production-dependencies` allows exactly this peer).
+    expect(Object.keys(manifest.dependencies ?? {})).toEqual(["@ekklesia/design-tokens"]);
+    expect(manifest.devDependencies?.react).toBeDefined();
     expect(Object.keys(manifest.peerDependencies ?? {})).toEqual(["react"]);
   });