feat: integrate module authorization

Wires composePlatformPermissionRegistry into apps/api's production
startup: startApi() discovers every installed module, composes the one
immutable platform permission registry (Core's own declarations plus
every module's), and only then constructs the shared PostgreSQL pool,
Better Auth, and the HTTP server. A discovery or composition failure —
an invalid manifest, a reserved core.* namespace claim, or a duplicate
declaration — propagates before anything exists to close; there is no
Core-only registry fallback. apps/api/src/platform-permissions.ts
resolves the repository root from its own file location, never
process.cwd(), so package-scoped test runs discover the right modules/
directory.

createApiApp/createGrantsRoutes now require the composed registry as
an injected authorization option, replacing the previous hard-coded
CORE_PERMISSION_REGISTRY; requirePermission continues to work
identically for Core-owned and module-owned permissions, since it has
no concept of the distinction.

Extends pnpm doctor with a modules.permissions check (reusing the
already-discovered module list, distinguishing reserved-namespace from
generic-duplicate failures, never re-discovering modules) and pnpm
modules:validate to compose the same registry before a module is
considered installable.

Adds focused coverage: startup-ordering and failure-isolation tests in
apps/api/tests/lifecycle.test.ts, module-owned-declaration enforcement
tests in apps/api/tests/authorization-middleware.test.ts, Doctor
composition tests in core/tests/doctor.test.ts, and a live PostgreSQL
end-to-end scenario proving a real installed module's permission is
discoverable, grantable, and deniable once the module is absent again
after a restart, without ever executing its server entrypoint.

apps/api/tests/app.test.ts

@@ -1,5 +1,10 @@
 import { ANONYMOUS_PRINCIPAL, createAuthenticatedPrincipal } from "@ekklesia/contracts";
-import type { AuthorizationEvaluator, AuthorizationStore } from "@ekklesia/core/authorization";
+import {
+  type AuthorizationEvaluator,
+  type AuthorizationStore,
+  CORE_PERMISSION_REGISTRY,
+  type PermissionRegistry,
+} from "@ekklesia/core/authorization";
 import type { EkklesiaIdentityRuntime } from "@ekklesia/core/identity";
 import { IdentityRuntimeError } from "@ekklesia/core/identity";
 import { describe, expect, it, vi } from "vitest";
@@ -17,9 +22,13 @@ function fakeRuntime(overrides: Partial<EkklesiaIdentityRuntime> = {}): Ekklesia
 }
 
 /** A fully stubbed authorization dependency, denying everything by default — tests that need a
- * specific decision or store behavior override the relevant method explicitly. */
+ * specific decision or store behavior override the relevant method explicitly. The registry
+ * defaults to Core's own (containing `core.authorization.grants.manage`, exactly what the
+ * mounted grants routes require) rather than an app-composed one — these tests exercise
+ * `createApiApp`'s wiring, not permission composition itself. */
 function fakeAuthorization(overrides: {
   readonly evaluator?: Partial<AuthorizationEvaluator>;
+  readonly registry?: PermissionRegistry;
   readonly store?: Partial<AuthorizationStore>;
 }): CreateApiAppAuthorizationOptions {
   const evaluator: AuthorizationEvaluator = {
@@ -36,7 +45,7 @@ function fakeAuthorization(overrides: {
     revokePlatformOwner: vi.fn(),
     ...overrides.store,
   };
-  return { evaluator, store };
+  return { evaluator, registry: overrides.registry ?? CORE_PERMISSION_REGISTRY, store };
 }
 
 describe("Ekklesia API Hono application", () => {
@@ -253,6 +262,32 @@ describe("Ekklesia API Hono application", () => {
       expect(evaluatorAuthorize).toHaveBeenCalledTimes(1);
     });
 
+    it("uses exactly the injected registry, never an internal Core-only fallback", async () => {
+      // An evaluator that would allow anything, paired with a registry that does not register
+      // core.authorization.grants.manage at all — if createApiApp silently fell back to some
+      // internal registry containing it, this request would reach the evaluator and succeed
+      // (empty grant list, 200). It must instead fail closed on the registry lookup itself.
+      const evaluatorAuthorize = vi.fn().mockResolvedValue({ allowed: true });
+      const emptyRegistry: PermissionRegistry = {
+        declarations: [],
+        get: () => undefined,
+        has: () => false,
+      };
+      const app = createApiApp({
+        authorization: fakeAuthorization({
+          evaluator: { authorize: evaluatorAuthorize },
+          registry: emptyRegistry,
+        }),
+        runtime: fakeRuntime(),
+        trustedOrigins: [trustedOrigin],
+      });
+
+      const response = await app.request("/api/v1/grants?userId=user_123");
+
+      expect(response.status).toBe(403);
+      expect(evaluatorAuthorize).not.toHaveBeenCalled();
+    });
+
     it("applies the same CORS policy to /api/v1/grants as the rest of /api/v1/*", async () => {
       const app = createApiApp({
         authorization: fakeAuthorization({}),