feat: add native module realtime transport

apps/api/src/module-ui-inventory.ts

@@ -9,6 +9,7 @@ import {
   requirePermission,
 } from "./authorization-middleware.js";
 import { moduleApiBaseUrl } from "./module-http-routes.js";
+import { moduleRealtimeBaseUrl } from "./module-realtime-routes.js";
 import { MODULE_UI_ASSET_PREFIX, moduleUiArtifactUrl } from "./module-ui-routes.js";
 
 /**
@@ -44,6 +45,9 @@ export interface HostModuleUiDescriptor {
    * `ui.url` is: `/api/v1/modules/<id>` is Ekklesia's private deployment detail, and neither the
    * module nor the browser host should be the one spelling it. */
   readonly api: { readonly baseUrl: string };
+  /** Server-produced root for this module's host-neutral browser realtime facade. The browser host,
+   * not module UI, resolves and appends a validated local channel. */
+  readonly realtime: { readonly baseUrl: string };
   /**
    * The subset of **this module's own declared permissions** that the current principal holds,
    * evaluated server-side by Core's one authorization evaluator.
@@ -115,6 +119,7 @@ async function describeModule(
     api: { baseUrl: moduleApiBaseUrl(published.moduleId) },
     id: published.moduleId,
     permissions: await grantedPermissionIds(evaluator, principal, published.permissions),
+    realtime: { baseUrl: moduleRealtimeBaseUrl(published.moduleId) },
     ui: { url: moduleUiArtifactUrl(published) },
     version: published.version,
   };