fix(03): resolve tenant context for module activation

Controller now falls back to user.tenantId from JWT when
req.tenantId is null (SUPER_ADMIN without x-tenant-id header).
Also added error display to admin modules page.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps/api/src/module-registry/module-registry.controller.ts

@@ -46,7 +46,7 @@ export class ModuleRegistryController {
    */
   @Get('active')
   async findActive(@Req() req: Request) {
-    const tenantId = (req as any).tenantId;
+    const tenantId = (req as any).tenantId ?? (req as any).user?.tenantId;
     if (!tenantId) {
       throw new ForbiddenException('No tenant context');
     }
@@ -66,7 +66,7 @@ export class ModuleRegistryController {
     @Param('moduleId') moduleId: string,
     @Req() req: Request,
   ) {
-    const tenantId = (req as any).tenantId;
+    const tenantId = (req as any).tenantId ?? (req as any).user?.tenantId;
     if (!tenantId) {
       throw new ForbiddenException('No tenant context');
     }
@@ -85,7 +85,7 @@ export class ModuleRegistryController {
     @Param('moduleId') moduleId: string,
     @Req() req: Request,
   ) {
-    const tenantId = (req as any).tenantId;
+    const tenantId = (req as any).tenantId ?? (req as any).user?.tenantId;
     if (!tenantId) {
       throw new ForbiddenException('No tenant context');
     }

apps/web/src/app/(portal)/admin/modules/page.tsx

@@ -32,6 +32,7 @@ export default function AdminModulesPage() {
   const [activations, setActivations] = useState<Map<string, boolean>>(new Map());
   const [loading, setLoading] = useState(true);
   const [toggling, setToggling] = useState<string | null>(null);
+  const [error, setError] = useState<string | null>(null);
 
   const isAdmin = currentUser?.role === 'ADMIN' || currentUser?.role === 'SUPER_ADMIN';
 
@@ -72,6 +73,7 @@ export default function AdminModulesPage() {
 
   const toggleModule = async (moduleId: string, currentlyActive: boolean) => {
     setToggling(moduleId);
+    setError(null);
     try {
       const action = currentlyActive ? 'deactivate' : 'activate';
       const res = await fetch(`${API_URL}/modules/${moduleId}/${action}`, {
@@ -89,9 +91,12 @@ export default function AdminModulesPage() {
           }
           return next;
         });
+      } else {
+        const body = await res.text().catch(() => '');
+        setError(`${res.status}: ${body}`);
       }
-    } catch {
-      // silently fail
+    } catch (err) {
+      setError(String(err));
     } finally {
       setToggling(null);
     }
@@ -117,6 +122,12 @@ export default function AdminModulesPage() {
         <p className="mt-1 text-sm text-muted-foreground">{t('description')}</p>
       </div>
 
+      {error && (
+        <div className="rounded-md border border-destructive/50 bg-destructive/10 p-3 text-sm text-destructive">
+          {error}
+        </div>
+      )}
+
       {loading ? (
         <p className="text-muted-foreground">{tCommon('loading')}</p>
       ) : modules.length === 0 ? (