feat(03-01): add ModuleRegistry NestJS module with CRUD and activation endpoints

- ModuleRegistryService with findAll, findBySlug, findActiveForTenant, activate/deactivate, seedModule
- ModuleRegistryController with GET /modules, GET /modules/active, POST activate/deactivate
- ModuleGuard + @UseModule() decorator for tenant-scoped module access control
- ActivateModuleDto with UUID validation
- Registered ModuleRegistryModule in AppModule imports

apps/api/src/app.module.ts

@@ -8,6 +8,7 @@ import { ForcePasswordChangeInterceptor } from './auth/interceptors/force-passwo
 import { HealthModule } from './health/health.module';
 import { LdapModule } from './ldap/ldap.module';
 import { MailModule } from './mail/mail.module';
+import { ModuleRegistryModule } from './module-registry/module-registry.module';
 import { PrismaModule } from './prisma/prisma.module';
 import { TenantMiddleware } from './tenant/tenant.middleware';
 import { TenantModule } from './tenant/tenant.module';
@@ -23,6 +24,7 @@ import { UserModule } from './user/user.module';
     HealthModule,
     MailModule,
     LdapModule,
+    ModuleRegistryModule,
   ],
   providers: [
     // Global JWT guard: all routes require auth unless @Public()