Add module management system for enabling/disabling features

Stores can enable/disable feature modules from Settings. When disabled,
nav links are hidden and API routes return 403. Designed as the
foundation for future license-based gating (licensed + enabled flags).

Core modules (Accounts, Members, Users, Roles, Settings) are always on.

- module_config table with slug, name, description, licensed, enabled
- In-memory cache for fast per-request module checks
- requireModule middleware wraps route groups in main.ts
- Settings page Modules card with toggle switches
- Sidebar hides nav links for disabled modules
- Default modules seeded: inventory, pos, repairs, rentals, lessons,
  files, vault, email, reports

packages/backend/api-tests/run.ts

@@ -91,6 +91,22 @@ async function setupDatabase() {
     }
   }
 
+  // Seed default modules
+  const DEFAULT_MODULES = [
+    { slug: 'inventory', name: 'Inventory', description: 'Product catalog, stock tracking, and unit management', enabled: true },
+    { slug: 'pos', name: 'Point of Sale', description: 'Sales transactions, cash drawer, and receipts', enabled: true },
+    { slug: 'repairs', name: 'Repairs', description: 'Repair ticket management, batches, and service templates', enabled: true },
+    { slug: 'rentals', name: 'Rentals', description: 'Instrument rental agreements and billing', enabled: false },
+    { slug: 'lessons', name: 'Lessons', description: 'Lesson scheduling, instructor management, and billing', enabled: false },
+    { slug: 'files', name: 'Files', description: 'Shared file storage with folder organization', enabled: true },
+    { slug: 'vault', name: 'Vault', description: 'Encrypted password and secret manager', enabled: true },
+    { slug: 'email', name: 'Email', description: 'Email campaigns, templates, and sending', enabled: false },
+    { slug: 'reports', name: 'Reports', description: 'Business reports and data export', enabled: true },
+  ]
+  for (const m of DEFAULT_MODULES) {
+    await testSql`INSERT INTO module_config (slug, name, description, licensed, enabled) VALUES (${m.slug}, ${m.name}, ${m.description}, true, ${m.enabled}) ON CONFLICT (slug) DO NOTHING`
+  }
+
   await testSql.end()
   console.log('  Database ready')
 }