feat: one generic image, with installed modules in installation-owned storage (ADR 0048)

The production image now contains zero feature modules and is the same for every
installation. Installed modules live in module storage that one Core resolver
selects from EKKLESIA_MODULES_DIR: the checkout's modules/ when unset, an
absolute path that must exist when set (/var/lib/ekklesia/modules in the image).
A relative, blank, missing, or unreadable configured directory fails closed with
a sanitized error that never contains the value.

- Host configuration reads EKKLESIA_MODULES_DIR. The API, migration plan, apply
  and validate, module validation, module enablement, and Doctor all resolve it
  the same way; the test-only API override still takes precedence.
- Doctor receives Core's migrations directory explicitly instead of deriving it
  from the modules directory's parent.
- The migration runner retains and reports the applied history of a module that
  is not installed, and plans and applies Core's and present modules' migrations
  around it. Core's history and every installed module's history stay strict: a
  missing or changed applied migration, or a downgrade, still fails. No down
  migrations, no data deletion.
- deploy/Dockerfile copies no module and installs nothing for the module
  template; .dockerignore excludes modules/ and the build refuses a context that
  contains it; the runtime has an empty root-owned /var/lib/ekklesia/modules and
  sets EKKLESIA_MODULES_DIR.
- deploy/compose.yaml bind-mounts EKKLESIA_MODULES_HOST_DIR read-only into api
  and migrate, with create_host_path disabled.
- scripts/check-image.sh proves the image holds no modules and that a populated
  modules/ directory leaves its runtime file system identical; CI runs it.
- The split deploy smoke now uses the same generic image: it boots with no
  modules, installs a self-contained test module packaged from the template
  (test-only), migrates and restarts, removes it (Core runs, planning reports the
  retained history, data survives), and restores it with its data.

Docs: deploy README (module storage, install/update/remove/restore, the runtime
modules target), .env.example, API configuration, module development guide,
testing, workflow, security, and the architecture overview.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

.github/workflows/ci.yml

@@ -152,23 +152,14 @@ jobs:
       - name: Sweep stale CI stacks from the runner
         run: bash scripts/ci-sweep.sh --stale
 
-      # The platform-only image (ADR 0044): a checkout has no `modules/`, so this proves the image
-      # builds, validates, and assembles with zero modules. Build only — no registry login, no
-      # credentials, no push, no tag anywhere but this runner's local image store.
-      # Tagged per run and attempt, not only per commit: a pull request and a push of the same commit
-      # can build at once on one runner's Docker daemon, and neither may remove the other's image.
-      # Labeled like every CI stack, so this job's final step removes it even if the build is killed.
-      - name: Build the production image without modules
-        shell: bash
-        run: |
-          source scripts/lib/ci-project.sh
-          docker build \
-            --file deploy/Dockerfile \
-            --build-arg REVISION="$GITHUB_SHA" \
-            --label "${EKKLESIA_CI_LABEL}=$(ci_project_name image)" \
-            --label "${EKKLESIA_CI_CREATED_LABEL}=$(date +%s)" \
-            --tag ekklesia-ci:"$GITHUB_SHA-${GITHUB_RUN_ID:-0}-${GITHUB_RUN_ATTEMPT:-1}" \
-            .
+      # The one generic platform image (ADR 0044, ADR 0048), proved rather than assumed: it contains no
+      # module, no module template, and no module manifest; its module storage mount point is empty;
+      # EKKLESIA_MODULES_DIR names it; and a checkout with a populated modules/ directory builds an
+      # identical runtime file system. Build only — no registry login, no credentials, no push, no tag
+      # anywhere but this runner's local image store. Tagged per run and attempt, and labeled like
+      # every CI stack, so this job's final step removes the images even if a build is killed.
+      - name: Build the generic platform image and prove it holds no modules
+        run: bash scripts/check-image.sh
 
       # Whatever happened above, this job's own stacks do not outlive it.
       - name: Remove this job's CI stacks
@@ -179,8 +170,9 @@ jobs:
     needs: verify
     runs-on: ubuntu-latest
     timeout-minutes: 30
-    # Both topologies (ADR 0045): same-origin, the default every installation gets, and split, which
-    # adds a test-only module and drives a real headless browser across the two origins.
+    # Both topologies (ADR 0045), each on the one generic image: same-origin, the default every
+    # installation gets, and split, which installs a test-only module into module storage, removes
+    # it, and restores it (ADR 0048), and drives a real headless browser across the two origins.
     strategy:
       fail-fast: false
       matrix:
@@ -206,7 +198,7 @@ jobs:
       - name: Sweep stale CI stacks from the runner
         run: bash scripts/ci-sweep.sh --stale
 
-      # The reference deployment end to end (ADR 0044): a platform-only image, base + proxy with
+      # The reference deployment end to end (ADR 0044): the generic platform image, base + proxy with
       # Caddy's internal CA (test-only), an explicit migration apply against this job's own fresh
       # PostgreSQL, then the API, Dashboard, storage delivery, client-address chain, and verify-full
       # database TLS through the proxy. Every secret is generated for this run and discarded with